{ "timestamp": "2026-10-15T05:36:14Z", "kernels": [ { "version": "7.2.10", "variant": "", "update": [], "unfixed": [ { "id": "CVE-2026-68086", "title": "mm/khugepaged: write all dirty file folios when collapsing", "description": "[There is no upstream commit, as this code was removed by upstream commit 044925f9b565 (\"mm: fs: remove filemap_nr_thps*() functions and their users\")]", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68086", "fixed_mainline": "", "cvss": null, "severity": "" } ], "filtered": true, "not_built": 5, "update_to": "" }, { "version": "7.2.10", "variant": "cloud", "update": [], "unfixed": [], "filtered": true, "not_built": 6, "update_to": "" }, { "version": "6.18.55", "variant": "", "update": [ { "id": "CVE-2026-80734", "title": "btrfs: initialize inode mapping flags for cached inodes", "description": "[BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size:", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80734", "fixed_in": "6.18.56", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80729", "title": "mm/huge_memory: initialise workingset state before folio split", "description": "xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but __folio_split() leaves the xa_state's xa_lru unset. That lets a live, memcg-charged xa_node exist without being linked into the mapping's shadow_nodes list_lru; when reclaim later walks the list_lru it trips VM_WARN_ON(!css_is_dying()).", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80729", "fixed_in": "6.18.56", "cvss": null, "severity": "" }, { "id": "CVE-2026-98375", "title": "xen/netfront: drop RX packets with a short Ethernet header", "description": "handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN.", "published": "2026-10-09", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98375", "fixed_in": "6.18.56", "cvss": null, "severity": "" } ], "unfixed": [ { "id": "CVE-2026-72493", "title": "net: serialize netif_running() check in enqueue_to_backlog()", "description": "Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup().", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72493", "fixed_mainline": "7.2", "cvss": 9.9, "severity": "CRITICAL" }, { "id": "CVE-2026-64067", "title": "netfs: Fix missing barriers when accessing stream->subrequests locklessly", "description": "The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64067", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64160", "title": "netfs: Fix potential for tearing in ->remote_i_size and ->zero_point", "description": "Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64160", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-72477", "title": "fs/ntfs3: call _ntfs_bad_inode() when failing to rename", "description": "It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce (\"fs/ntfs3: Exclude call make_bad_inode for live nodes.\")", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72477", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74723", "title": "btrfs: lzo: reject inline extents without valid headers", "description": "[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74723", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-80634", "title": "netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag", "description": "The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80634", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-80668", "title": "netfilter: nf_conntrack_expect: use conntrack GC to reap expectations", "description": "This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80668", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-90104", "title": "NFSv4.1: zero referring call lists before decoding", "description": "decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90104", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-89537", "title": "SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2", "description": "gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89537", "fixed_mainline": "7.3", "cvss": 9.1, "severity": "CRITICAL" }, { "id": "CVE-2026-64117", "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb", "description": "ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does:", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64117", "fixed_mainline": "7.1", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-68470", "title": "wifi: mac80211: validate extension-frame layout before RX", "description": "Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68470", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74277", "title": "iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path", "description": "In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74277", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74530", "title": "Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74530", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74533", "title": "Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero", "description": "hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74533", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74561", "title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush", "description": "nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74561", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74562", "title": "nexthop: take nh->lock for f6i_list walks in replace check and notify", "description": "fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74562", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80692", "title": "Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80692", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90256", "title": "Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind", "description": "hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90256", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90380", "title": "wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete", "description": "A use-after-free issue occurs in mt76_rx_poll_complete due to a race condition. The STA has already been removed, but the rx_status still had a pointer to the wcid in the STA.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90380", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90381", "title": "wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()", "description": "When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each struct ieee80211_vif_chanctx_switch.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90381", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-93189", "title": "HID: core: quiesce input in hid_hw_stop() to prevent use-after-free", "description": "A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93189", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-53091", "title": "net: pull headers in qdisc_pkt_len_segs_init()", "description": "Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53091", "fixed_mainline": "7.1", "cvss": 8.4, "severity": "HIGH" }, { "id": "CVE-2026-31771", "title": "Bluetooth: hci_event: move wake reason storage into validated event handlers", "description": "hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31771", "fixed_mainline": "7.0", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-89709", "title": "lockd, nfsd: RCU-protect nlmsvc_ops dispatch", "description": "nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89709", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-46311", "title": "drm/amdgpu/userq: fix access to stale wptr mapping", "description": "Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly.", "published": "2026-06-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46311", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63858", "title": "netfilter: nf_tables: add hook transactions for device deletions", "description": "Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63858", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63879", "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages", "description": "The notifier sequence must only be read once or otherwise we could work with invalid pages.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63879", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68305", "title": "drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers", "description": "CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68305", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68382", "title": "drm/xe/guc: Hold device ref until queue teardown completes", "description": "GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68382", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68383", "title": "drm/xe/guc: Keep scheduler timeline name alive", "description": "The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68383", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68399", "title": "bpf: Fix UAF in sock clone early bailouts", "description": "Similar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage before bailouts that access it\"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68399", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68404", "title": "wifi: cfg80211: use wiphy work for socket owner autodisconnect", "description": "nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68404", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74260", "title": "netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them", "description": "Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74260", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74314", "title": "bpf: Cancel special fields on map value recycle", "description": "Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74314", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74317", "title": "ixgbe: do not configure xps for XDP queues", "description": "netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74317", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74338", "title": "bpf: Reject sleepable BPF_LSM_CGROUP programs at load time", "description": "The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74338", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74354", "title": "bpf: Take mmap_lock in zap_pages()", "description": "zap_vma_range() requires the owning mm's mmap_lock to be held.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74354", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74367", "title": "wifi: ath12k: fix inconsistent arvif state in vdev_create error paths", "description": "ath12k_mac_vdev_create() has three error path issues that leave arvif in an inconsistent state:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74367", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74529", "title": "Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74529", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74605", "title": "eventfs: Use children field for rcu head and add memory barriers", "description": "When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target.", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74605", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74747", "title": "ipvs: revalidate ihl to prevent out-of-bounds access", "description": "While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74747", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80579", "title": "fbdev: clear fb_info->mode before deleting a videomode", "description": "fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80579", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80580", "title": "fbdev: bound mode sysfs output to the sysfs buffer", "description": "mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80580", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89584", "title": "block: validate user space vectors during extraction", "description": "The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dma_alignment as the bio is built from the iov_iter, rejecting misaligned early with -EINVAL.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89584", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90093", "title": "Bluetooth: L2CAP: access chan->conn safely in get/setsockopt", "description": "Since commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90093", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90142", "title": "virtio_net: Fix resize of the RX ring", "description": "When a AF_XDP socket is attached, the virtnet_rx_resize should resize the rq->xsk_buffs XSK buffer array. Otherwise, when the size grows, the virtnet_rx_resume() causes a write past the end of the array. This is easily reproducable with", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90142", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90177", "title": "bpf: Check pointer type for all atomic RMW paths", "description": "Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90177", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90237", "title": "netfilter: nft_ct: move custom expectation support to helper", "description": "Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for confirmed conntrack\") which restricted it to unconfirmed conntracks.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90237", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90317", "title": "bpf: Invalidate RCU pointers after final spin unlock", "description": "In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90317", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-92485", "title": "bpf: Fix WARNING in bpf_tracing_link_release", "description": "The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92485", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93105", "title": "esp: do not unref managed frag pages in esp_ssg_unref()", "description": "esp_ssg_unref() releases the page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for an out-of-place transform (req->src != req->dst), and in the error path of esp_output_tail() (already_unref == true) on the request's own scatterlist.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93105", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93125", "title": "bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max", "description": "check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64, and does not bound it. check_kfunc_call() later copies that value into the returned register's mem_size field:", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93125", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93144", "title": "bpf: Reject writes through untrusted BTF pointers", "description": "check_ptr_to_btf_access() lets program-type btf_struct_access callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpf_rdonly_cast().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93144", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93148", "title": "bpf: Reject MEM_ALLOC BTF accesses past object bounds", "description": "BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static BTF type size.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93148", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-98364", "title": "xfrm: hold net_device reference under RCU in bundle creation", "description": "xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98364", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90408", "title": "wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()", "description": "There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90408", "fixed_mainline": "7.3", "cvss": 7.7, "severity": "HIGH" }, { "id": "CVE-2026-64020", "title": "nvme-pci: fix dma_vecs leak on p2p memory", "description": "We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64020", "fixed_mainline": "7.1", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-74745", "title": "eth: bnxt: avoid deadlock when canceling IRQ affinity notifier", "description": "Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74745", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-80631", "title": "btrfs: lzo: reject compressed segment that overflows the compressed input", "description": "lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL f", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80631", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-90234", "title": "NFS: Return a delegation the client fails to record", "description": "When an NFS server grants a delegation in an OPEN reply, nfs_inode_set_delegation() records it on the client. However, three of its error flows return without sending DELEGRETURN.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90234", "fixed_mainline": "7.3", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-80738", "title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie", "description": "bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket.", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80738", "fixed_mainline": "7.2", "cvss": 7.3, "severity": "HIGH" }, { "id": "CVE-2026-43042", "title": "mpls: add seqcount to protect the platform_label{,s} pair", "description": "The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43042", "fixed_mainline": "7.0", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-68103", "title": "drm/amdgpu: reject mapping a reserved doorbell to a new queue", "description": "When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68103", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-90401", "title": "md: remove REQ_NOWAIT support from raid1/10/456", "description": "REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where one mirror succeeds while another returns -EAGAIN. At that point md cannot distinguish queue pressure from a real device failure, so it can neither record a bad block nor safely retry the write without REQ_NOWAIT, le", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90401", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-93116", "title": "platform/x86: asus-wmi: fix resource leaks on probe failure", "description": "During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93116", "fixed_mainline": "7.3", "cvss": 7.0, "severity": "HIGH" }, { "id": "CVE-2026-100072", "title": "ACPI: platform: Use acpi_bus_get_primary_device()", "description": "The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1].", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100072", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-100073", "title": "ext4: fix transaction overflow during writeback", "description": "Commit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent conversion\") was correct to note that we need to reserve enough credits for all extents possibly underlying a large folio. However it was too eager to reduce the number of reserved credits. Extent conversion may not only need to touch several leaf extent blocks, it may also need to split extents - for example a single large unwrit", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100073", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-23374", "title": "blktrace: fix __this_cpu_read/write in preemptible context", "description": "tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()).", "published": "2026-03-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23374", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43022", "title": "Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists", "description": "hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43022", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43053", "title": "xfs: close crash window in attr dabtree inactivation", "description": "When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the roo", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43053", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43174", "title": "io_uring/zcrx: fix post open error handling", "description": "Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing the zcrx ctx directly.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43174", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43299", "title": "btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()", "description": "[BUG] There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO (this part is expected, although the ENOSPC bug still needs to be addressed).", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43299", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43308", "title": "btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()", "description": "There is no need to BUG(), we can just return an error and log an error message.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43308", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43326", "title": "sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback", "description": "SCX_KICK_WAIT busy-waits in kick_cpus_irq_workfn() using smp_cond_load_acquire() until the target CPU's kick_sync advances. Because the irq_work runs in hardirq context, the waiting CPU cannot reschedule and its own kick_sync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43326", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-46017", "title": "mm: fix deferred split queue races during migration", "description": "migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio().", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46032", "title": "KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT", "description": "If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exception", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46032", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46153", "title": "8021q: delete cleared egress QoS mappings", "description": "vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory.", "published": "2026-05-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46153", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-52949", "title": "drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure", "description": "Apply the same fix as b2ed01e7ad (\"drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure\") to the ttm_bo_shrink() path.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52949", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-52965", "title": "drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure", "description": "When ttm_tt_swapout() fails, the current code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52965", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53017", "title": "f2fs: fix data loss caused by incorrect use of nat_entry flag", "description": "Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows:", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53106", "title": "bpf: Do not allow deleting local storage in NMI", "description": "Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation req", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53106", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53257", "title": "wifi: cfg80211: enforce HE/EHT cap/oper consistency", "description": "Xiang Mei reports that mac80211 could crash if eht_cap is set but eht_oper isn't. Rather than fixing that for the individual user(s), enforce that both HE/EHT have consistent elements.", "published": "2026-06-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53257", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-63811", "title": "f2fs: read COW data with the original inode during atomic write", "description": "When updating an atomic-write file, f2fs_write_begin() may read the previously written data back from the COW inode: prepare_atomic_write_begin() locates the block in the COW inode and sets use_cow, and the read bio is then built with the COW inode:", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63811", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-64013", "title": "ACPI: button: Fix ACPI GPE handler leak during removal", "description": "Commit a7e23ec17fee (\"ACPI: button: Install notifier for system events as well\") changed the ACPI notify handler type for ACPI buttons to ACPI_ALL_NOTIFY, but it forgot to update acpi_button_remove() to reflect that change. This leads to leaking the notify handler past driver removal, which may cause a kernel crash to occur if ACPI notify on the given device is triggered after removing the driver,", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64013", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64019", "title": "nvme-pci: fix dma mapping leak on data setup error", "description": "We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64019", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64079", "title": "netfilter: x_tables: allocate hook ops while under mutex", "description": "arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64079", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64159", "title": "netfs: Fix zeropoint update where i_size > remote_i_size", "description": "Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64159", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64325", "title": "wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", "description": "This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/", "published": "2026-07-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64325", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68086", "title": "mm/khugepaged: write all dirty file folios when collapsing", "description": "[There is no upstream commit, as this code was removed by upstream commit 044925f9b565 (\"mm: fs: remove filemap_nr_thps*() functions and their users\")]", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68086", "fixed_mainline": "", "cvss": null, "severity": "" }, { "id": "CVE-2026-68105", "title": "drm/amdgpu: Fix kernel panic during driver load failure", "description": "Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68105", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68242", "title": "drm/i915/gt: Fix NULL deref on sched_engine alloc failure", "description": "Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68242", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68375", "title": "bnxt_en: Handle partially initialized auxiliary devices", "description": "bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68441", "title": "net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains", "description": "When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected.", "published": "2026-08-12", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68441", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72031", "title": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD", "description": "The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72031", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72370", "title": "iomap: release pages on atomic dio size mismatch", "description": "If bio_iov_iter_get_pages() or the bounce helper succeeds but builds a short bio, the REQ_ATOMIC size check rejects it before submission. The old error path only dropped the bio reference, leaving any pages already attached to the bio unreleased.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72370", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74307", "title": "ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT", "description": "Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside ext4_move_extents() by mext_check_validity(), but only after lock_two_nondirectories() has already acquired the inode locks. When the donor fd refers to a file on a different filesystem (e.g., overlayfs), this late validation creates", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74307", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74342", "title": "kernfs: link kn to its parent before the LSM init hook", "description": "After commit 12e9e3cd03b5 (\"simpe_xattr: use per-sb cache\"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74342", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74375", "title": "md/raid1,raid10: fix deadlock in read error recovery path", "description": "raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended before md_handle_request() acquires an active_io reference via percpu_ref_tryget_live().", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74542", "title": "netfs: Fix folio_queue ENOMEM in writeback by adding a mempool", "description": "Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74542", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74558", "title": "xsk: reclaim invalid Tx descriptors in ZC batch path", "description": "The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74558", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74571", "title": "btrfs: skip global block reserve accounting for rescue mounts", "description": "[BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74571", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74754", "title": "scsi: core: pair EH runtime PM get and put", "description": "shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host().", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74754", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80785", "title": "fbdev: serialize mode sysfs access with lock_fb_info()", "description": "show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one.", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80785", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80786", "title": "fbdev: Wrap user-invoked calls to fb_set_var() in helper", "description": "Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80786", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-89772", "title": "btrfs: write-protect folios during data writeback", "description": "commit 095be159f3eb (\"btrfs: unify folio dirty flag clearing\") replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check. Besides clearing the dirty flag, folio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects the shared mmap PTEs mapping the folio. Note that we still do call folio_clear_dirty_for_io() later in submit_one_", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89772", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89812", "title": "drm/amdgpu: force complete the MES ring fences on reset", "description": "The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1 reset, while fence_drv.sync_seq keeps advancing for every packet.", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89812", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89813", "title": "drm/amdgpu: force complete the KIQ ring fences on reset", "description": "Like the MES scheduler ring, the KIQ ring sets no_scheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its hw fence value lives in wb (GTT) memory and survives a MODE1 reset while fence_drv.sync_seq keeps advancing, so after a reset the first KIQ submission can poll forever on a seq that is never written back.", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89813", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90040", "title": "KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped", "description": "Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core logic to handle invalidations as VMX does for the APIC-access page, as the two concepts are nearly identical: shove the physical address of a page into the vCPU's control structure:", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90040", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90061", "title": "netfilter: nf_tables: skip double clone set expressions on element insert", "description": "Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuratio", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90061", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90087", "title": "Bluetooth: do not leak an hci_conn when a second LE connect is rejected", "description": "create_le_conn_complete() decides whether the failed connection is still pending by comparing it against hci_lookup_le_connect(), which returns the first LE connection in BT_CONNECT. That is the same connection only while at most one is pending.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90087", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90095", "title": "fuse: Fix the condition to enable over-io-uring", "description": "The existing condition in fuse_uring_cmd() is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORING_OP_URING_CMD if the connection/channel didn't get enabled because of missing FUSE_INIT reply flag FUSE_OVER_IO_URING. Without the reply flag the barrier in fuse_uring_ready() doesn't work and IO could already be going on and cau", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90095", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90099", "title": "net/sched: account classifier filter allocations to memcg", "description": "Allocations in the tc classifier *_change() paths (filter objects, per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without __GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside memcg charging. The shared tcf_exts_init_ex() action array allocation in cls_api.c was also uncharged; this patch closes it along with the per-classifier filter-object/percpu/aux allocation", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90106", "title": "net: bridge: arp/nd proxy: fix reading neigh ha", "description": "Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90106", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90182", "title": "blk-iocost: clear delay state when freeing policy data", "description": "iocg_kick_delay() turns sufficiently large debt into an explicit block-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to -1 and incrementing blkcg->congestion_count. Clearing it again depends on iocg_kick_delay() running from the period timer, the waitq timer or the issue path.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90182", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90183", "title": "blk-iolatency: clear delay state when freeing policy data", "description": "io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90183", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90242", "title": "iommu/vt-d: Fix iopf_refcount leak on RID domain replacement", "description": "intel_iommu_attach_device() enables IOPF for the new domain but never disables it for the old one. device_block_translation(), called at the start of the function, tears down translation but does not touch any IOPF state; blocking_domain_attach_dev() has to call iopf_for_domain_remove() explicitly before invoking it for exactly this reason.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90242", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90261", "title": "btrfs: zoned: flush active metadata block group at btree_writepages() start", "description": "btree_writepages() writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block group is active for writing at a time, and check_bg_is_active() (via btrfs_check_meta_write_pointer()) pivots the active block group as writeback moves from one block group to the next.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90261", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90263", "title": "btrfs: check if root is readonly when setting posix acl", "description": "For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs ro property is true.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90263", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90267", "title": "scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails", "description": "sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90267", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90300", "title": "bpf: Clear buf on error in __bpf_get_task_stack", "description": "Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90300", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90311", "title": "thermal: hwmon: Remove hwmon class device along with its parent", "description": "The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90311", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90315", "title": "PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "description": "Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90315", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90335", "title": "tty: skip cdev_del() when no cdev is registered", "description": "TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer dereference.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90335", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90336", "title": "serial: core: clear freed pointers on uart_register_driver() failure", "description": "uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90336", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90337", "title": "serial: core: do fallible allocations before the console can be registered", "description": "serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90337", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90345", "title": "wifi: brcmfmac: fix P2P action frame handling without device vif", "description": "Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary interface, or when action-frame abort runs after the P2P device vif has not been created.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90345", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90346", "title": "wifi: nl80211: clean up color-change beacon data on errors", "description": "nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90346", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90359", "title": "bpf: Reject >8 byte return values on return-reading trampoline paths", "description": "btf_distill_func_proto() builds the function model used for the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has accepted a 16-byte __int128 return value since the trampoline was introduced: __get_type_size() returns the integer's type size, and the return-type check only rejected ret < 0.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90359", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90421", "title": "PCI: Fix UAF when probe runs concurrent to dyn ID removal", "description": "Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90421", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92503", "title": "ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()", "description": "Syzbot/stress-ng reported an ABBA deadlock in ext4 when exercising concurrent xattr workloads (using the ea_inode mount/format option).", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92503", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93044", "title": "bpf: Disallow interpreter fallback for arena-related insns", "description": "Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::__bpf_prog_select_runtime().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93044", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93129", "title": "platform/x86: dell-wmi-base: Fix handling of ultra performance key", "description": "The commit message of commit 5fbd827eb9c2 (\"platform/x86: dell-wmi: Recognise or support new switches\") states that the ultra performance key contains additional data after the type and code fields. The event data passed to dell_wmi_process_key() is already parsed, so \"buffer\" already starts after those two fields.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93129", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93164", "title": "uprobes/x86: Move optimized uprobe from nop5 to nop10", "description": "Andrii reported an issue with optimized uprobes [1] that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data without adjusting rsp.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93164", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93181", "title": "perf/x86/intel/uncore: Fix uncore_box ref/unref ordering", "description": "In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93181", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93248", "title": "drm/xe: don't WARN on kernel job timeout when device already wedged", "description": "igt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2 (UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind, a GSC proxy kernel submission can still time out; with the device wedged and the GuC CT stopped it can never complete, so its kernel job times out.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93248", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93251", "title": "ACPI: bus: Introduce acpi_bus_get_primary_device()", "description": "The function used for obtaining the first \"physical\" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node(), may return a stale device pointer (mostly in theory) because acpi_unbind_one() may run as a whole after dropping the ACPI device's physical_node_lock in acpi_get_first_physical_node() and before it returns. The last reference to the \"physical\" device may b", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93251", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93270", "title": "bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn", "description": "The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + '.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93270", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97928", "title": "drm/amdgpu: skip the VMID 0 flush for VRAM", "description": "Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA flush can wedge the engine; only flush when a GART window is actually used.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97928", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97933", "title": "tracing: Take trace_array reference when opening a tracer options file", "description": "When a tracer option file is opened, it is passed a descriptor that points to an element on the trace_array's topts array. This element has information to find the trace array and other information. It uses this element to take a reference of the trace_array so that the trace_array does not get removed while this file is opened.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97933", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97997", "title": "virtio_ring: fix stale descriptor flags after a failed packed add", "description": "In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every round of the ring, tracked by a wrap counter, so invalidating or validating a descriptor means inverting both bits.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97997", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98019", "title": "bpf: mark a NULL call argument precise", "description": "check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98019", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98032", "title": "tracing: Fix subbuf resize races with trace_pipe_raw readers", "description": "Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98032", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98033", "title": "bpf: Preserve inner map identity in callback frames", "description": "Callback frame constructors initialize map-typed argument registers with __mark_reg_known_zero() and then restore map_ptr. This clears map_uid, which is the only field distinguishing inner maps that share an inner_map_meta template.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98033", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98034", "title": "bpf: Mark NULL kptr stores precise", "description": "check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98034", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98038", "title": "bpf: Keep refcount_acquire nullable for borrowed RCU kptrs", "description": "bpf_refcount_acquire() is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF_RET_NULL on the return value unless the argument is an owning reference.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98038", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98043", "title": "bpf: Don't infer non-NULL from a pointer with an unbounded offset", "description": "reg_not_null() decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL base, in case of an unbound offset the runtime offset value might still add up to NULL. Consider the followng program:", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98043", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98048", "title": "bpf: don't rewrite bpf_fastcall patterns entered by a jump", "description": "mark_fastcall_pattern_for_call() must ensure that matched \"spill; call; fill\" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98048", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98057", "title": "ring-buffer: Add checking nr_subbufs to persistent ring buffer validation", "description": "Sashiko reported that the code was using meta->nr_subbufs without making sure that it matched the nr_pages + 1 on data that was assuming the two were the same.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98057", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98058", "title": "bpf: Mark syscall helpers as sleepable", "description": "bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98058", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98099", "title": "ipv6: mcast: use rcu_assign_pointer() for __rcu list updates", "description": "Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98106", "title": "drm/pagemap: Prevent double migration of device pages", "description": "A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98106", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98118", "title": "netfs: Fix readahead synchronisation issues by loading all folios upfront", "description": "There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at them or trying to clear them, such as determining the setting of front_folio_order when the next folio hasn't been added yet,", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98118", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98134", "title": "bpf: check_cond_jmp_op(): properly infer if register is null", "description": "Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example:", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98134", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98147", "title": "printk: Don't WARN on kthread_run failure.", "description": "Since __kthread_create_on_node() returns -EINTR upon SIGKILL, we should not use WARN_ON() in order to catch kthread_run() failure.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98147", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98153", "title": "nvme: fix racy access to FDP placement id array", "description": "nvme_query_fdp_info() is called per-path and therefore prone to races.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98153", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98284", "title": "netlink: do not free nlk->groups while lockless readers can use it", "description": "netlink_realloc_groups() uses krealloc() under netlink_table_grab(). Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old bitmap is freed immediately.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98284", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98332", "title": "wifi: mac80211: only operate on TDLS peers in the TDLS code", "description": "ieee80211_tdls_oper() can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused for a TDLS peer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98332", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98333", "title": "wifi: mac80211: reset the LED state when ifup fails", "description": "When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98333", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98338", "title": "wifi: cfg80211: ibss: ref BSS entry for joined event", "description": "When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with NL80211_SCAN_FLAG_FLUSH can remove it, causing a warning in the event work:", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98338", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98376", "title": "bpf: Use array_map_meta_equal for percpu array inner map replacement", "description": "percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds.", "published": "2026-10-09", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98376", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-98427", "title": "net/sched: codel: bound the dropping loop per dequeue call", "description": "The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way.", "published": "2026-10-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98427", "fixed_mainline": "7.3", "cvss": null, "severity": "" } ], "filtered": true, "not_built": 213, "update_to": "6.18.56" }, { "version": "6.18.55", "variant": "cloud", "update": [ { "id": "CVE-2026-80734", "title": "btrfs: initialize inode mapping flags for cached inodes", "description": "[BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size:", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80734", "fixed_in": "6.18.56", "cvss": 8.8, "severity": "HIGH" } ], "unfixed": [ { "id": "CVE-2026-72493", "title": "net: serialize netif_running() check in enqueue_to_backlog()", "description": "Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup().", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72493", "fixed_mainline": "7.2", "cvss": 9.9, "severity": "CRITICAL" }, { "id": "CVE-2026-64067", "title": "netfs: Fix missing barriers when accessing stream->subrequests locklessly", "description": "The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64067", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64160", "title": "netfs: Fix potential for tearing in ->remote_i_size and ->zero_point", "description": "Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64160", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74723", "title": "btrfs: lzo: reject inline extents without valid headers", "description": "[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74723", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-80668", "title": "netfilter: nf_conntrack_expect: use conntrack GC to reap expectations", "description": "This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80668", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-90104", "title": "NFSv4.1: zero referring call lists before decoding", "description": "decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90104", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-89537", "title": "SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2", "description": "gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89537", "fixed_mainline": "7.3", "cvss": 9.1, "severity": "CRITICAL" }, { "id": "CVE-2026-64117", "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb", "description": "ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does:", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64117", "fixed_mainline": "7.1", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-68470", "title": "wifi: mac80211: validate extension-frame layout before RX", "description": "Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68470", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74277", "title": "iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path", "description": "In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74277", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74561", "title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush", "description": "nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74561", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74562", "title": "nexthop: take nh->lock for f6i_list walks in replace check and notify", "description": "fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74562", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-93189", "title": "HID: core: quiesce input in hid_hw_stop() to prevent use-after-free", "description": "A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93189", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-53091", "title": "net: pull headers in qdisc_pkt_len_segs_init()", "description": "Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53091", "fixed_mainline": "7.1", "cvss": 8.4, "severity": "HIGH" }, { "id": "CVE-2026-89709", "title": "lockd, nfsd: RCU-protect nlmsvc_ops dispatch", "description": "nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89709", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-63858", "title": "netfilter: nf_tables: add hook transactions for device deletions", "description": "Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63858", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68399", "title": "bpf: Fix UAF in sock clone early bailouts", "description": "Similar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage before bailouts that access it\"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68399", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68404", "title": "wifi: cfg80211: use wiphy work for socket owner autodisconnect", "description": "nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68404", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74314", "title": "bpf: Cancel special fields on map value recycle", "description": "Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74314", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74317", "title": "ixgbe: do not configure xps for XDP queues", "description": "netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74317", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74605", "title": "eventfs: Use children field for rcu head and add memory barriers", "description": "When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target.", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74605", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80579", "title": "fbdev: clear fb_info->mode before deleting a videomode", "description": "fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80579", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80580", "title": "fbdev: bound mode sysfs output to the sysfs buffer", "description": "mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80580", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89584", "title": "block: validate user space vectors during extraction", "description": "The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dma_alignment as the bio is built from the iov_iter, rejecting misaligned early with -EINVAL.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89584", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90142", "title": "virtio_net: Fix resize of the RX ring", "description": "When a AF_XDP socket is attached, the virtnet_rx_resize should resize the rq->xsk_buffs XSK buffer array. Otherwise, when the size grows, the virtnet_rx_resume() causes a write past the end of the array. This is easily reproducable with", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90142", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90237", "title": "netfilter: nft_ct: move custom expectation support to helper", "description": "Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for confirmed conntrack\") which restricted it to unconfirmed conntracks.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90237", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-92485", "title": "bpf: Fix WARNING in bpf_tracing_link_release", "description": "The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92485", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93105", "title": "esp: do not unref managed frag pages in esp_ssg_unref()", "description": "esp_ssg_unref() releases the page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for an out-of-place transform (req->src != req->dst), and in the error path of esp_output_tail() (already_unref == true) on the request's own scatterlist.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93105", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93148", "title": "bpf: Reject MEM_ALLOC BTF accesses past object bounds", "description": "BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static BTF type size.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93148", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-98364", "title": "xfrm: hold net_device reference under RCU in bundle creation", "description": "xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98364", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-64020", "title": "nvme-pci: fix dma_vecs leak on p2p memory", "description": "We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64020", "fixed_mainline": "7.1", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-74745", "title": "eth: bnxt: avoid deadlock when canceling IRQ affinity notifier", "description": "Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74745", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-80631", "title": "btrfs: lzo: reject compressed segment that overflows the compressed input", "description": "lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL f", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80631", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-90234", "title": "NFS: Return a delegation the client fails to record", "description": "When an NFS server grants a delegation in an OPEN reply, nfs_inode_set_delegation() records it on the client. However, three of its error flows return without sending DELEGRETURN.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90234", "fixed_mainline": "7.3", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-80738", "title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie", "description": "bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket.", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80738", "fixed_mainline": "7.2", "cvss": 7.3, "severity": "HIGH" }, { "id": "CVE-2026-43042", "title": "mpls: add seqcount to protect the platform_label{,s} pair", "description": "The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43042", "fixed_mainline": "7.0", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-90401", "title": "md: remove REQ_NOWAIT support from raid1/10/456", "description": "REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where one mirror succeeds while another returns -EAGAIN. At that point md cannot distinguish queue pressure from a real device failure, so it can neither record a bad block nor safely retry the write without REQ_NOWAIT, le", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90401", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-100072", "title": "ACPI: platform: Use acpi_bus_get_primary_device()", "description": "The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1].", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100072", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-100073", "title": "ext4: fix transaction overflow during writeback", "description": "Commit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent conversion\") was correct to note that we need to reserve enough credits for all extents possibly underlying a large folio. However it was too eager to reduce the number of reserved credits. Extent conversion may not only need to touch several leaf extent blocks, it may also need to split extents - for example a single large unwrit", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100073", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-23374", "title": "blktrace: fix __this_cpu_read/write in preemptible context", "description": "tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()).", "published": "2026-03-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23374", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43053", "title": "xfs: close crash window in attr dabtree inactivation", "description": "When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the roo", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43053", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43174", "title": "io_uring/zcrx: fix post open error handling", "description": "Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing the zcrx ctx directly.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43174", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43299", "title": "btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()", "description": "[BUG] There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO (this part is expected, although the ENOSPC bug still needs to be addressed).", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43299", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43308", "title": "btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()", "description": "There is no need to BUG(), we can just return an error and log an error message.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43308", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43326", "title": "sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback", "description": "SCX_KICK_WAIT busy-waits in kick_cpus_irq_workfn() using smp_cond_load_acquire() until the target CPU's kick_sync advances. Because the irq_work runs in hardirq context, the waiting CPU cannot reschedule and its own kick_sync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43326", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-46017", "title": "mm: fix deferred split queue races during migration", "description": "migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio().", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53257", "title": "wifi: cfg80211: enforce HE/EHT cap/oper consistency", "description": "Xiang Mei reports that mac80211 could crash if eht_cap is set but eht_oper isn't. Rather than fixing that for the individual user(s), enforce that both HE/EHT have consistent elements.", "published": "2026-06-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53257", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64013", "title": "ACPI: button: Fix ACPI GPE handler leak during removal", "description": "Commit a7e23ec17fee (\"ACPI: button: Install notifier for system events as well\") changed the ACPI notify handler type for ACPI buttons to ACPI_ALL_NOTIFY, but it forgot to update acpi_button_remove() to reflect that change. This leads to leaking the notify handler past driver removal, which may cause a kernel crash to occur if ACPI notify on the given device is triggered after removing the driver,", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64013", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64019", "title": "nvme-pci: fix dma mapping leak on data setup error", "description": "We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64019", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64079", "title": "netfilter: x_tables: allocate hook ops while under mutex", "description": "arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64079", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64159", "title": "netfs: Fix zeropoint update where i_size > remote_i_size", "description": "Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64159", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-68375", "title": "bnxt_en: Handle partially initialized auxiliary devices", "description": "bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68441", "title": "net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains", "description": "When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected.", "published": "2026-08-12", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68441", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72031", "title": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD", "description": "The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72031", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72370", "title": "iomap: release pages on atomic dio size mismatch", "description": "If bio_iov_iter_get_pages() or the bounce helper succeeds but builds a short bio, the REQ_ATOMIC size check rejects it before submission. The old error path only dropped the bio reference, leaving any pages already attached to the bio unreleased.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72370", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74307", "title": "ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT", "description": "Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside ext4_move_extents() by mext_check_validity(), but only after lock_two_nondirectories() has already acquired the inode locks. When the donor fd refers to a file on a different filesystem (e.g., overlayfs), this late validation creates", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74307", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74342", "title": "kernfs: link kn to its parent before the LSM init hook", "description": "After commit 12e9e3cd03b5 (\"simpe_xattr: use per-sb cache\"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74342", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74375", "title": "md/raid1,raid10: fix deadlock in read error recovery path", "description": "raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended before md_handle_request() acquires an active_io reference via percpu_ref_tryget_live().", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74542", "title": "netfs: Fix folio_queue ENOMEM in writeback by adding a mempool", "description": "Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74542", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74558", "title": "xsk: reclaim invalid Tx descriptors in ZC batch path", "description": "The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74558", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74571", "title": "btrfs: skip global block reserve accounting for rescue mounts", "description": "[BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74571", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74754", "title": "scsi: core: pair EH runtime PM get and put", "description": "shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host().", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74754", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80785", "title": "fbdev: serialize mode sysfs access with lock_fb_info()", "description": "show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one.", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80785", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80786", "title": "fbdev: Wrap user-invoked calls to fb_set_var() in helper", "description": "Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80786", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-89772", "title": "btrfs: write-protect folios during data writeback", "description": "commit 095be159f3eb (\"btrfs: unify folio dirty flag clearing\") replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check. Besides clearing the dirty flag, folio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects the shared mmap PTEs mapping the folio. Note that we still do call folio_clear_dirty_for_io() later in submit_one_", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89772", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90040", "title": "KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped", "description": "Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core logic to handle invalidations as VMX does for the APIC-access page, as the two concepts are nearly identical: shove the physical address of a page into the vCPU's control structure:", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90040", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90061", "title": "netfilter: nf_tables: skip double clone set expressions on element insert", "description": "Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuratio", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90061", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90099", "title": "net/sched: account classifier filter allocations to memcg", "description": "Allocations in the tc classifier *_change() paths (filter objects, per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without __GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside memcg charging. The shared tcf_exts_init_ex() action array allocation in cls_api.c was also uncharged; this patch closes it along with the per-classifier filter-object/percpu/aux allocation", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90182", "title": "blk-iocost: clear delay state when freeing policy data", "description": "iocg_kick_delay() turns sufficiently large debt into an explicit block-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to -1 and incrementing blkcg->congestion_count. Clearing it again depends on iocg_kick_delay() running from the period timer, the waitq timer or the issue path.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90182", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90183", "title": "blk-iolatency: clear delay state when freeing policy data", "description": "io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90183", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90242", "title": "iommu/vt-d: Fix iopf_refcount leak on RID domain replacement", "description": "intel_iommu_attach_device() enables IOPF for the new domain but never disables it for the old one. device_block_translation(), called at the start of the function, tears down translation but does not touch any IOPF state; blocking_domain_attach_dev() has to call iopf_for_domain_remove() explicitly before invoking it for exactly this reason.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90242", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90261", "title": "btrfs: zoned: flush active metadata block group at btree_writepages() start", "description": "btree_writepages() writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block group is active for writing at a time, and check_bg_is_active() (via btrfs_check_meta_write_pointer()) pivots the active block group as writeback moves from one block group to the next.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90261", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90267", "title": "scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails", "description": "sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90267", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90311", "title": "thermal: hwmon: Remove hwmon class device along with its parent", "description": "The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90311", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90315", "title": "PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "description": "Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90315", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90335", "title": "tty: skip cdev_del() when no cdev is registered", "description": "TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer dereference.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90335", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90336", "title": "serial: core: clear freed pointers on uart_register_driver() failure", "description": "uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90336", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90337", "title": "serial: core: do fallible allocations before the console can be registered", "description": "serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90337", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90346", "title": "wifi: nl80211: clean up color-change beacon data on errors", "description": "nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90346", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90421", "title": "PCI: Fix UAF when probe runs concurrent to dyn ID removal", "description": "Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90421", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92503", "title": "ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()", "description": "Syzbot/stress-ng reported an ABBA deadlock in ext4 when exercising concurrent xattr workloads (using the ea_inode mount/format option).", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92503", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93164", "title": "uprobes/x86: Move optimized uprobe from nop5 to nop10", "description": "Andrii reported an issue with optimized uprobes [1] that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data without adjusting rsp.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93164", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93181", "title": "perf/x86/intel/uncore: Fix uncore_box ref/unref ordering", "description": "In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93181", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93251", "title": "ACPI: bus: Introduce acpi_bus_get_primary_device()", "description": "The function used for obtaining the first \"physical\" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node(), may return a stale device pointer (mostly in theory) because acpi_unbind_one() may run as a whole after dropping the ACPI device's physical_node_lock in acpi_get_first_physical_node() and before it returns. The last reference to the \"physical\" device may b", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93251", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93270", "title": "bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn", "description": "The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + '.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93270", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97933", "title": "tracing: Take trace_array reference when opening a tracer options file", "description": "When a tracer option file is opened, it is passed a descriptor that points to an element on the trace_array's topts array. This element has information to find the trace array and other information. It uses this element to take a reference of the trace_array so that the trace_array does not get removed while this file is opened.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97933", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97997", "title": "virtio_ring: fix stale descriptor flags after a failed packed add", "description": "In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every round of the ring, tracked by a wrap counter, so invalidating or validating a descriptor means inverting both bits.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97997", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98032", "title": "tracing: Fix subbuf resize races with trace_pipe_raw readers", "description": "Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98032", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98048", "title": "bpf: don't rewrite bpf_fastcall patterns entered by a jump", "description": "mark_fastcall_pattern_for_call() must ensure that matched \"spill; call; fill\" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98048", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98057", "title": "ring-buffer: Add checking nr_subbufs to persistent ring buffer validation", "description": "Sashiko reported that the code was using meta->nr_subbufs without making sure that it matched the nr_pages + 1 on data that was assuming the two were the same.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98057", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98099", "title": "ipv6: mcast: use rcu_assign_pointer() for __rcu list updates", "description": "Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98118", "title": "netfs: Fix readahead synchronisation issues by loading all folios upfront", "description": "There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at them or trying to clear them, such as determining the setting of front_folio_order when the next folio hasn't been added yet,", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98118", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98147", "title": "printk: Don't WARN on kthread_run failure.", "description": "Since __kthread_create_on_node() returns -EINTR upon SIGKILL, we should not use WARN_ON() in order to catch kthread_run() failure.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98147", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98153", "title": "nvme: fix racy access to FDP placement id array", "description": "nvme_query_fdp_info() is called per-path and therefore prone to races.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98153", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98284", "title": "netlink: do not free nlk->groups while lockless readers can use it", "description": "netlink_realloc_groups() uses krealloc() under netlink_table_grab(). Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old bitmap is freed immediately.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98284", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98332", "title": "wifi: mac80211: only operate on TDLS peers in the TDLS code", "description": "ieee80211_tdls_oper() can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused for a TDLS peer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98332", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98333", "title": "wifi: mac80211: reset the LED state when ifup fails", "description": "When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98333", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98338", "title": "wifi: cfg80211: ibss: ref BSS entry for joined event", "description": "When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with NL80211_SCAN_FLAG_FLUSH can remove it, causing a warning in the event work:", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98338", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98427", "title": "net/sched: codel: bound the dropping loop per dequeue call", "description": "The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way.", "published": "2026-10-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98427", "fixed_mainline": "7.3", "cvss": null, "severity": "" } ], "filtered": true, "not_built": 277, "update_to": "6.18.56" }, { "version": "6.12.112", "variant": "", "update": [], "unfixed": [ { "id": "CVE-2026-72493", "title": "net: serialize netif_running() check in enqueue_to_backlog()", "description": "Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup().", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72493", "fixed_mainline": "7.2", "cvss": 9.9, "severity": "CRITICAL" }, { "id": "CVE-2025-68359", "title": "btrfs: fix double free of qgroup record after failure to add delayed ref head", "description": "In the previous code it was possible to incur into a double kfree() scenario when calling add_delayed_ref_head(). This could happen if the record was reported to already exist in the btrfs_qgroup_trace_extent_nolock() call, but then there was an error later on add_delayed_ref_head(). In this case, since add_delayed_ref_head() returned an error, the caller went to free the record. Since add_delayed", "published": "2025-12-24", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68359", "fixed_mainline": "6.19", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-63979", "title": "net/handshake: hand off the pinned file reference to accept_doit", "description": "handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() t", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63979", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64066", "title": "netfs: Fix netfs_read_to_pagecache() to pause on subreq failure", "description": "Fix netfs_read_to_pagecache() so that it pauses the generation of new subrequests if an already-issued subrequest fails.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64066", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64067", "title": "netfs: Fix missing barriers when accessing stream->subrequests locklessly", "description": "The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64067", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64068", "title": "netfs: Fix missing locking around retry adding new subreqs", "description": "Fix netfs_retry_read_subrequests() and netfs_retry_write_stream() to take the appropriate lock when adding extra subrequests into stream->subrequests.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64068", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64160", "title": "netfs: Fix potential for tearing in ->remote_i_size and ->zero_point", "description": "Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64160", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-68426", "title": "xfrm: fix stale skb->prev after async crypto steals a GSO segment", "description": "skb_gso_segment() leaves the segment list head with ->prev pointing at the last segment, an invariant validate_xmit_skb_list() relies on when it sets its tail pointer (tail = skb->prev).", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68426", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-72355", "title": "netfs: Fix barriering when walking subrequest list", "description": "Fix the barriering used when walking the subrequest list in retry as there's a possibility of seeing a subreq that's just been added by the application thread.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72355", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-72366", "title": "netfs: Fix netfs_create_write_req() to handle async cache object creation", "description": "netfs_create_write_req() will skip caching if the fscache cookie is disabled, but this is a problem because async cache object creation might not have got far enough yet that has been enabled - thereby causing the call to fscache_begin_write_operation() to be skipped.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72366", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74269", "title": "bnxt: fix head underflow on XDP head-grow", "description": "The xdp.py test test_xdp_native_adjst_head_grow_data crashes when run on a bnxt machine (and also crashes in NIPA).", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74269", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74723", "title": "btrfs: lzo: reject inline extents without valid headers", "description": "[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74723", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-80668", "title": "netfilter: nf_conntrack_expect: use conntrack GC to reap expectations", "description": "This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80668", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-90104", "title": "NFSv4.1: zero referring call lists before decoding", "description": "decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90104", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64024", "title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction", "description": "Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()):", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64024", "fixed_mainline": "7.1", "cvss": 9.4, "severity": "CRITICAL" }, { "id": "CVE-2026-43083", "title": "net: ioam6: fix OOB and missing lock", "description": "When trace->type.bit6 is set:", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43083", "fixed_mainline": "7.0", "cvss": 9.1, "severity": "CRITICAL" }, { "id": "CVE-2026-89537", "title": "SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2", "description": "gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89537", "fixed_mainline": "7.3", "cvss": 9.1, "severity": "CRITICAL" }, { "id": "CVE-2025-39862", "title": "wifi: mt76: mt7915: fix list corruption after hardware restart", "description": "Since stations are recreated from scratch, all lists that wcids are added to must be cleared before calling ieee80211_restart_hw. Set wcid->sta = 0 for each wcid entry in order to ensure that they are not added again before they are ready.", "published": "2025-09-19", "url": "https://www.cve.org/CVERecord?id=CVE-2025-39862", "fixed_mainline": "6.17", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2025-68304", "title": "Bluetooth: hci_core: lookup hci_conn on RX path on protocol side", "description": "The hdev lock/lookup/unlock/use pattern in the packet RX path doesn't ensure hci_conn* is not concurrently modified/deleted. This locking appears to be leftover from before conn_hash started using RCU commit bf4c63252490b (\"Bluetooth: convert conn hash to RCU\") and not clear if it had purpose since then.", "published": "2025-12-16", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68304", "fixed_mainline": "6.18", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2025-71202", "title": "iommu/sva: invalidate stale IOTLB entries for kernel address space", "description": "Introduce a new IOMMU interface to flush IOTLB paging cache entries for the CPU kernel address space. This interface is invoked from the x86 architecture code that manages combined user and kernel page tables, specifically before any kernel page table page is freed and reused.", "published": "2026-02-14", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71202", "fixed_mainline": "6.19", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-31435", "title": "netfs: Fix read abandonment during retry", "description": "Under certain circumstances, all the remaining subrequests from a read request will get abandoned during retry. The abandonment process expects the 'subreq' variable to be set to the place to start abandonment from, but it doesn't always have a useful value (it will be uninitialised on the first pass through the loop and it may point to a deleted subrequest on later passes).", "published": "2026-04-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31435", "fixed_mainline": "7.0", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-43048", "title": "HID: core: Mitigate potential OOB by removing bogus memset()", "description": "The memset() in hid_report_raw_event() has the good intention of clearing out bogus data by zeroing the area from the end of the incoming data string to the assumed end of the buffer. However, as we have previously seen, doing so can easily result in OOB reads and writes in the subsequent thread of execution.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43048", "fixed_mainline": "7.0", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-43172", "title": "wifi: iwlwifi: fix 22000 series SMEM parsing", "description": "If the firmware were to report three LMACs (which doesn't exist in hardware) then using \"fwrt->smem_cfg.lmac[2]\" is an overrun of the array. Reject such and use IWL_FW_CHECK instead of WARN_ON in this function.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43172", "fixed_mainline": "7.0", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-53281", "title": "iommu/vt-d: Avoid NULL pointer dereference or refcount corruption", "description": "Commit 60f030f7418d (\"iommu/vt-d: Avoid use of NULL after WARN_ON_ONCE\") fixed a NULL pointer dereference in an unlikely situation partly.", "published": "2026-06-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53281", "fixed_mainline": "7.1", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-63832", "title": "wifi: mt76: add wcid publish check in mt76_sta_add", "description": "Since mt7925_mac_sta_add publishes wcid, add publish check in mt76_sta_add to avoid reinitializing the wcid->poll_list.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63832", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-64117", "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb", "description": "ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does:", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64117", "fixed_mainline": "7.1", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-68393", "title": "Bluetooth: hci_sync: extend conn_hash lookup critical sections", "description": "Using RCU-protected pointers outside the critical sections without refcount is incorrect and may result to UAF.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68393", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-68409", "title": "wifi: mac80211: defer link RX stats percpu free to RCU", "description": "sta_remove_link() frees a removed MLO link's RX stats percpu buffer right away, but defers only the link container to RCU:", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68409", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-68470", "title": "wifi: mac80211: validate extension-frame layout before RX", "description": "Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68470", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74407", "title": "wifi: ath11k: cancel SSR work items during PCI shutdown", "description": "A reboot can crash the kernel if it overlaps with WLAN firmware crash recovery (SSR). The crash is a NULL pointer dereference in the MHI teardown path while freeing DMA-backed MHI contexts.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74407", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74520", "title": "iommu/iommufd: Fix IOPF group ownership UAF", "description": "iopf_group_alloc() links each last-page IOPF group into the generic IOPF pending list before invoking the domain fault handler. iommufd_fault_iopf_handler() also queued an accepted group in the IOMMUFD deliver list without removing it from the generic pending list.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74520", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74530", "title": "Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74530", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74533", "title": "Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero", "description": "hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74533", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74534", "title": "Bluetooth: ISO: fix refcounting of iso_conn", "description": "iso_conn_del() and iso_chan_del() have a race that results to double-put of iso_conn:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74534", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74537", "title": "Bluetooth: ISO: hold sk properly in iso_conn_ready", "description": "sk deref in iso_conn_ready must be done either under conn->lock, or holding a refcount, to avoid concurrent close. conn->sk is currently accessed without either:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74537", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74538", "title": "Bluetooth: ISO: lock sk in iso_connect_ind", "description": "Accessing iso_pi(sk)->conn requires lock_sock, which is not taken in the \"ev3\" part of iso_connect_ind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before locking.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74538", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80692", "title": "Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80692", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80721", "title": "Bluetooth: ISO: ensure no dangling hcon references in iso_conn", "description": "After iso_conn_del(), ISO sockets should not dereference the hcon any more. Currently, clearing iso_conn::hcon relies on iso_conn_del() releasing the last reference to the iso_conn.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80721", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80734", "title": "btrfs: initialize inode mapping flags for cached inodes", "description": "[BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size:", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80734", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90240", "title": "iommu/vt-d: Flush context cache with correct SID when tearing down aliases", "description": "domain_context_clear_one() and device_pasid_table_teardown() are both invoked once per DMA alias of a device. Each function locates the context entry using the bus/devfn pair provided by the pci_for_each_dma_alias() callback, then calls intel_context_flush_no_pasid(), which constructs a device-selective context-cache invalidation from info->bus and info->devfn (that is, always the requester ID of ", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90240", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90256", "title": "Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind", "description": "hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90256", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90379", "title": "wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash", "description": "When an AER error occurs and the bus is hung, the register reads return 0xFFFFFFFF, causing the DMA queue state to be corrupted and resulting in an invalid memory access when accessing q->desc[] or q->entry[].", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90379", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-93189", "title": "HID: core: quiesce input in hid_hw_stop() to prevent use-after-free", "description": "A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93189", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-53091", "title": "net: pull headers in qdisc_pkt_len_segs_init()", "description": "Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53091", "fixed_mainline": "7.1", "cvss": 8.4, "severity": "HIGH" }, { "id": "CVE-2025-68360", "title": "wifi: mt76: wed: use proper wed reference in mt76 wed driver callabacks", "description": "MT7996 driver can use both wed and wed_hif2 devices to offload traffic from/to the wireless NIC. In the current codebase we assume to always use the primary wed device in wed callbacks resulting in the following crash if the hw runs wed_hif2 (e.g. 6GHz link).", "published": "2025-12-24", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68360", "fixed_mainline": "6.19", "cvss": 8.2, "severity": "HIGH" }, { "id": "CVE-2026-74697", "title": "bnxt_en: Disable EOP for TPA on all chips to prevent data corruption", "description": "EOP (End of frame padding) on the AGG ring may cause overlapping of zero padding at the end of one segment with the next segment's data. If Relaxed Ordering (RO) is enabled, the zero padding may overwrite valid data in the next segment and corrupt the data. Older chips (P5 and older) do not automatically disable RO when EOP is enabled. On some ARM systems, data corruption was reported on 57508 (P5", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74697", "fixed_mainline": "7.2", "cvss": 8.2, "severity": "HIGH" }, { "id": "CVE-2025-40158", "title": "ipv6: use RCU in ip6_output()", "description": "Use RCU in ip6_output() in order to use dst_dev_rcu() to prevent possible UAF.", "published": "2025-11-12", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40158", "fixed_mainline": "6.18", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-31771", "title": "Bluetooth: hci_event: move wake reason storage into validated event handlers", "description": "hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31771", "fixed_mainline": "7.0", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-89709", "title": "lockd, nfsd: RCU-protect nlmsvc_ops dispatch", "description": "nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89709", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2025-22109", "title": "ax25: Remove broken autobind", "description": "Binding AX25 socket by using the autobind feature leads to memory leaks in ax25_connect() and also refcount leaks in ax25_release(). Memory leak was detected with kmemleak:", "published": "2025-04-16", "url": "https://www.cve.org/CVERecord?id=CVE-2025-22109", "fixed_mainline": "6.15", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2025-38064", "title": "virtio: break and reset virtio devices on device_shutdown()", "description": "Hongyu reported a hang on kexec in a VM. QEMU reported invalid memory accesses during the hang.", "published": "2025-06-18", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38064", "fixed_mainline": "6.15", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2025-38656", "title": "wifi: iwlwifi: Fix error code in iwl_op_mode_dvm_start()", "description": "Preserve the error code if iwl_setup_deferred_work() fails. The current code returns ERR_PTR(0) (which is NULL) on this path. I believe the missing error code potentially leads to a use after free involving debugfs.", "published": "2025-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38656", "fixed_mainline": "", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2025-39677", "title": "net/sched: Fix backlog accounting in qdisc_dequeue_internal", "description": "This issue applies for the following qdiscs: hhf, fq, fq_codel, and fq_pie, and occurs in their change handlers when adjusting to the new limit. The problem is the following in the values passed to the subsequent qdisc_tree_reduce_backlog call given a tbf parent:", "published": "2025-09-05", "url": "https://www.cve.org/CVERecord?id=CVE-2025-39677", "fixed_mainline": "6.17", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2025-40025", "title": "f2fs: fix to do sanity check on node footer for non inode dnode", "description": "As syzbot reported below:", "published": "2025-10-28", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40025", "fixed_mainline": "6.18", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2025-40190", "title": "ext4: guard against EA inode refcount underflow in xattr update", "description": "syzkaller found a path where ext4_xattr_inode_update_ref() reads an EA inode refcount that is already <= 0 and then applies ref_change (often -1). That lets the refcount underflow and we proceed with a bogus value, triggering errors like:", "published": "2025-11-12", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40190", "fixed_mainline": "6.18", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-43009", "title": "bpf: Fix incorrect pruning due to atomic fetch precision tracking", "description": "When backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC and BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as a destination, thus receiving the old value from the memory location.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43009", "fixed_mainline": "7.0", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-46324", "title": "netfilter: nf_tables: use list_del_rcu for netlink hooks", "description": "nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks need to use list_del_rcu(), this list can be walked by concurrent dumpers.", "published": "2026-06-09", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46324", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-52991", "title": "sched/psi: fix race between file release and pressure write", "description": "A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1].", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52991", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-53000", "title": "netfilter: nat: use kfree_rcu to release ops", "description": "Florian Westphal says:", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53000", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63819", "title": "f2fs: fix to do sanity check on f2fs_get_node_folio_ra()", "description": "kernel BUG at fs/f2fs/file.c:845! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 5336 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 RIP: 0010:f2fs_do_truncate_blocks+0x1115/0x1140 fs/f2fs/file.c:845 Code: fc fc 90 0f 0b e8 8b 9d 9a fd 90 0f 0b e8 83 9d 9a fd 48 89 df 48 c7 c6 60 d1", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63819", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63853", "title": "drm/amdgpu/vcn: set no_user_fence for VCN v4.0 enc ring", "description": "VCN encoder and decoder rings do not support 64-bit user fence writes, reject CS submissions with user fences.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63853", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63858", "title": "netfilter: nf_tables: add hook transactions for device deletions", "description": "Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63858", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63879", "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages", "description": "The notifier sequence must only be read once or otherwise we could work with invalid pages.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63879", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-64036", "title": "cgroup/rstat: validate cpu before css_rstat_cpu() access", "description": "css_rstat_updated() is exposed as a BPF kfunc and accepts a caller-provided cpu argument. The function uses cpu for per-cpu rstat lookups without checking whether it refers to a valid possible CPU.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64036", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-64078", "title": "netfilter: x_tables: add and use xtables_unregister_table_exit", "description": "Previous change added xtables_unregister_table_pre_exit to detach the table from the packetpath and to unlink it from the active table list. In case of rmmod, userspace that is doing set/getsockopt for this table will not be able to re-instantiate the table: 1. The larval table has been removed already 2. existing instantiated table is no longer on the xt pernet table list.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64078", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68382", "title": "drm/xe/guc: Hold device ref until queue teardown completes", "description": "GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68382", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68383", "title": "drm/xe/guc: Keep scheduler timeline name alive", "description": "The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68383", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68399", "title": "bpf: Fix UAF in sock clone early bailouts", "description": "Similar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage before bailouts that access it\"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68399", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68404", "title": "wifi: cfg80211: use wiphy work for socket owner autodisconnect", "description": "nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68404", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74257", "title": "sockmap: Fix use-after-free in udp_bpf_recvmsg()", "description": "syzbot reported use-after-free of struct sk_msg in sk_msg_recvmsg(). [0]", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74257", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74264", "title": "net: watchdog: fix refcount tracking races", "description": "Blamed commit converted the untracked dev_hold()/dev_put() calls in the watchdog code to use the tracked dev_hold_track()/dev_put_track() (which were later renamed/interfaced to netdev_hold() and netdev_put()).", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74264", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74314", "title": "bpf: Cancel special fields on map value recycle", "description": "Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74314", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74317", "title": "ixgbe: do not configure xps for XDP queues", "description": "netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74317", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74338", "title": "bpf: Reject sleepable BPF_LSM_CGROUP programs at load time", "description": "The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74338", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74344", "title": "bpf: Clear rb node linkage when freeing bpf_rb_root", "description": "bpf_rb_root_free() detaches the root by copying the current rb_root_cached and then replacing the live root with RB_ROOT_CACHED. It then walks the copied root and drops each object contained in the tree.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74344", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74354", "title": "bpf: Take mmap_lock in zap_pages()", "description": "zap_vma_range() requires the owning mm's mmap_lock to be held.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74354", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74529", "title": "Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74529", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74605", "title": "eventfs: Use children field for rcu head and add memory barriers", "description": "When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target.", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74605", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74747", "title": "ipvs: revalidate ihl to prevent out-of-bounds access", "description": "While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74747", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80579", "title": "fbdev: clear fb_info->mode before deleting a videomode", "description": "fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80579", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80580", "title": "fbdev: bound mode sysfs output to the sysfs buffer", "description": "mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80580", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-81010", "title": "io_uring/waitid: honor task_work cancellation", "description": "io_waitid_cb() may run through the fallback task_work path when task_work_add() can no longer queue work to the originating task. The fallback runs from a kworker and io_uring marks such task work as canceled through tw.cancel.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-81010", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90093", "title": "Bluetooth: L2CAP: access chan->conn safely in get/setsockopt", "description": "Since commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90093", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90142", "title": "virtio_net: Fix resize of the RX ring", "description": "When a AF_XDP socket is attached, the virtnet_rx_resize should resize the rq->xsk_buffs XSK buffer array. Otherwise, when the size grows, the virtnet_rx_resume() causes a write past the end of the array. This is easily reproducable with", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90142", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90146", "title": "bpf, xdp: move offload check into dev_xdp_install()", "description": "bpf_xdp_link_update() calls dev_xdp_install() directly and skips dev_xdp_attach(), so the checks in dev_xdp_attach() do not run. A user can make an XDP link with a normal program and then swap in an offloaded or device-bound program with BPF_LINK_UPDATE, which puts it on the software path.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90146", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90177", "title": "bpf: Check pointer type for all atomic RMW paths", "description": "Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90177", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90237", "title": "netfilter: nft_ct: move custom expectation support to helper", "description": "Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for confirmed conntrack\") which restricted it to unconfirmed conntracks.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90237", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90317", "title": "bpf: Invalidate RCU pointers after final spin unlock", "description": "In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90317", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90326", "title": "blk-cgroup: fix race between policy activation and blkg destruction", "description": "When switching an IO scheduler on a block device, blkcg_activate_policy() allocates blkg_policy_data (pd) for all blkgs attached to the queue. However, blkcg_activate_policy() may race with concurrent blkcg deletion, leading to use-after-free and memory leak issues.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90326", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90343", "title": "wifi: cfg80211: stop PMSR before P2P and NAN teardown", "description": "PMSR request teardown must abort active measurements while the wireless_dev is still present in the driver. cfg80211_leave_locked() and cfg80211_stop_pd() already do this before invoking the driver's stop callback, but cfg80211_stop_p2p_device() and cfg80211_stop_nan() do not.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90343", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-92485", "title": "bpf: Fix WARNING in bpf_tracing_link_release", "description": "The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92485", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93105", "title": "esp: do not unref managed frag pages in esp_ssg_unref()", "description": "esp_ssg_unref() releases the page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for an out-of-place transform (req->src != req->dst), and in the error path of esp_output_tail() (already_unref == true) on the request's own scatterlist.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93105", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93125", "title": "bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max", "description": "check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64, and does not bound it. check_kfunc_call() later copies that value into the returned register's mem_size field:", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93125", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93144", "title": "bpf: Reject writes through untrusted BTF pointers", "description": "check_ptr_to_btf_access() lets program-type btf_struct_access callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpf_rdonly_cast().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93144", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93148", "title": "bpf: Reject MEM_ALLOC BTF accesses past object bounds", "description": "BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static BTF type size.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93148", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-98073", "title": "net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().", "description": "syzbot reported the warning in cfg80211_pernet_exit(). [0]", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98073", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-98156", "title": "drm/virtio: use the DMA API for resource backing on Xen", "description": "On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtio_ring.c handles this correctly, vring_use_map_api() returns true for any xen_domain() regardless of VIRTIO_F_ACCESS_PLATFORM.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98156", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-98341", "title": "wifi: cfg80211: don't free driver-owned scan requests", "description": "When an interface goes down while a scan is running, cfg80211 completes the scan towards userspace and frees the scan request. However, the driver can be convinced that it owns the request, since the cancellation is (intended to be) asynchronous.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98341", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-98364", "title": "xfrm: hold net_device reference under RCU in bundle creation", "description": "xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98364", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90408", "title": "wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()", "description": "There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90408", "fixed_mainline": "7.3", "cvss": 7.7, "severity": "HIGH" }, { "id": "CVE-2026-43101", "title": "ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()", "description": "We need to check __in6_dev_get() for possible NULL value, as suggested by Yiming Qian.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43101", "fixed_mainline": "7.0", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-43213", "title": "wifi: rtw89: pci: validate sequence number of TX release report", "description": "Hardware rarely reports abnormal sequence number in TX release report, which will access out-of-bounds of wd_ring->pages array, causing NULL pointer dereference.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43213", "fixed_mainline": "7.0", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-53284", "title": "btrfs: only release the dirty pages io tree after successful writes", "description": "[WARNING] With extra warning on dirty extent buffers at umount (aka, the next patch in the series), test case generic/388 can trigger the following warning about dirty extent buffers at unmount time:", "published": "2026-06-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53284", "fixed_mainline": "7.1", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-74695", "title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()", "description": "Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74695", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-80631", "title": "btrfs: lzo: reject compressed segment that overflows the compressed input", "description": "lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL f", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80631", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-90149", "title": "NFSv4/flexfiles: fix NULL dereference for NFSv4.0 data servers", "description": "flexfiles accepts NFSv4.0 data servers, but two NFSv4 code paths assume the data server client has a session. Unlike NFSv4.1+, an NFSv4.0 client has no session (clp->cl_session is NULL; it uses clp->cl_slot_tbl), so I/O to a v4.0 flexfiles DS oopses:", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90149", "fixed_mainline": "7.3", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-90234", "title": "NFS: Return a delegation the client fails to record", "description": "When an NFS server grants a delegation in an OPEN reply, nfs_inode_set_delegation() records it on the client. However, three of its error flows return without sending DELEGRETURN.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90234", "fixed_mainline": "7.3", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-45932", "title": "bpf: Fix tcx/netkit detach permissions when prog fd isn't given", "description": "This commit fixes a security issue where BPF_PROG_DETACH on tcx or netkit devices could be executed by any user when no program fd was provided, bypassing permission checks. The fix adds a capability check for CAP_NET_ADMIN or CAP_SYS_ADMIN in this case.", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45932", "fixed_mainline": "7.0", "cvss": 7.3, "severity": "HIGH" }, { "id": "CVE-2026-80738", "title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie", "description": "bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket.", "published": "2026-09-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80738", "fixed_mainline": "7.2", "cvss": 7.3, "severity": "HIGH" }, { "id": "CVE-2026-43042", "title": "mpls: add seqcount to protect the platform_label{,s} pair", "description": "The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43042", "fixed_mainline": "7.0", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-46175", "title": "f2fs: fix fsck inconsistency caused by FGGC of node block", "description": "During FGGC node block migration, fsck may incorrectly treat the migrated node block as fsync-written data.", "published": "2026-05-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46175", "fixed_mainline": "7.1", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-52953", "title": "iommu/vt-d: Fix oops due to out of scope access", "description": "Below oops triggers when kill QEMU process:", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52953", "fixed_mainline": "7.1", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-53368", "title": "f2fs: fix fsck inconsistency caused by incorrect nat_entry flag usage", "description": "f2fs_need_dentry_mark() reads nat_entry flags without mutual exclusion with the checkpoint path, which can result in an incorrect inode block marking state. The scenario is as follows:", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53368", "fixed_mainline": "7.1", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-80685", "title": "mm/util: don't read __page_2 for order-1 folios in snapshot_page()", "description": "snapshot_page() currently reads __page_2 after checking nr_pages > 1, but it should only do so when nr_pages > 2.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80685", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-90260", "title": "btrfs: zoned: don't clobber the extent buffer when zeroing it out", "description": "On a zoned filesystem a freed-but-still-dirty tree block is written out as zeros (EXTENT_BUFFER_ZONED_ZEROOUT) only to keep the zone write pointer advancing. btree_csum_one_bio() implemented this by memzeroing the extent buffer's own folios before submission.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90260", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-90401", "title": "md: remove REQ_NOWAIT support from raid1/10/456", "description": "REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where one mirror succeeds while another returns -EAGAIN. At that point md cannot distinguish queue pressure from a real device failure, so it can neither record a bad block nor safely retry the write without REQ_NOWAIT, le", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90401", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2025-23132", "title": "f2fs: quota: fix to avoid warning in dquot_writeback_dquots()", "description": "F2FS-fs (dm-59): checkpoint=enable has some unwritten data.", "published": "2025-04-16", "url": "https://www.cve.org/CVERecord?id=CVE-2025-23132", "fixed_mainline": "6.15", "cvss": 7.0, "severity": "HIGH" }, { "id": "CVE-2026-93116", "title": "platform/x86: asus-wmi: fix resource leaks on probe failure", "description": "During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93116", "fixed_mainline": "7.3", "cvss": 7.0, "severity": "HIGH" }, { "id": "CVE-2026-98330", "title": "wifi: cfg80211: get the wiphy out of a dying network namespace", "description": "When a network namespace is destroyed, cfg80211_pernet_exit() moves any wiphy back to the initial namespace, and just warns if that fails. But moving an interface can fail (due to allocation failures), and then the wiphy is left behind with a garbage netns pointer:", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98330", "fixed_mainline": "7.3", "cvss": 7.0, "severity": "HIGH" }, { "id": "CVE-2025-39910", "title": "mm/vmalloc, mm/kasan: respect gfp mask in kasan_populate_vmalloc()", "description": "kasan_populate_vmalloc() and its helpers ignore the caller's gfp_mask and always allocate memory using the hardcoded GFP_KERNEL flag. This makes them inconsistent with vmalloc(), which was recently extended to support GFP_NOFS and GFP_NOIO allocations.", "published": "2025-10-01", "url": "https://www.cve.org/CVERecord?id=CVE-2025-39910", "fixed_mainline": "6.17", "cvss": 5.5, "severity": "MEDIUM" }, { "id": "CVE-2024-58074", "title": "drm/i915: Grab intel_display from the encoder to avoid potential oopsies", "description": "Grab the intel_display from 'encoder' rather than 'state' in the encoder hooks to avoid the massive footgun that is intel_sanitize_encoder(), which passes NULL as the 'state' argument to encoder .disable() and .post_disable().", "published": "2025-03-06", "url": "https://www.cve.org/CVERecord?id=CVE-2024-58074", "fixed_mainline": "6.14", "cvss": null, "severity": "" }, { "id": "CVE-2025-21752", "title": "btrfs: don't use btrfs_set_item_key_safe on RAID stripe-extents", "description": "Don't use btrfs_set_item_key_safe() to modify the keys in the RAID stripe-tree, as this can lead to corruption of the tree, which is caught by the checks in btrfs_set_item_key_safe():", "published": "2025-02-26", "url": "https://www.cve.org/CVERecord?id=CVE-2025-21752", "fixed_mainline": "6.14", "cvss": null, "severity": "" }, { "id": "CVE-2025-37743", "title": "wifi: ath12k: Avoid memory leak while enabling statistics", "description": "Driver uses monitor destination rings for extended statistics mode and standalone monitor mode. In extended statistics mode, TLVs are parsed from the buffer received from the monitor destination ring and assigned to the ppdu_info structure to update per-packet statistics. In standalone monitor mode, along with per-packet statistics, the packet data (payload) is captured, and the driver updates per", "published": "2025-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2025-37743", "fixed_mainline": "6.15", "cvss": null, "severity": "" }, { "id": "CVE-2025-38036", "title": "drm/xe/vf: Perform early GT MMIO initialization to read GMDID", "description": "VFs need to communicate with the GuC to obtain the GMDID value and existing GuC functions used for that assume that the GT has it's MMIO members already setup. However, due to recent refactoring the gt->mmio is initialized later, and any attempt by the VF to use xe_mmio_read|write() from GuC functions will lead to NPD crash due to unset MMIO register address:", "published": "2025-06-18", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38036", "fixed_mainline": "6.15", "cvss": null, "severity": "" }, { "id": "CVE-2025-38140", "title": "dm: limit swapping tables for devices with zone write plugs", "description": "dm_revalidate_zones() only allowed new or previously unzoned devices to call blk_revalidate_disk_zones(). If the device was already zoned, disk->nr_zones would always equal md->nr_zones, so dm_revalidate_zones() returned without doing any work. This would make the zoned settings for the device not match the new table. If the device had zone write plug resources, it could run into errors like bdev_", "published": "2025-07-03", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38140", "fixed_mainline": "6.16", "cvss": null, "severity": "" }, { "id": "CVE-2025-38199", "title": "wifi: ath12k: Fix memory leak due to multiple rx_stats allocation", "description": "rx_stats for each arsta is allocated when adding a station. arsta->rx_stats will be freed when a station is removed.", "published": "2025-07-04", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38199", "fixed_mainline": "6.16", "cvss": null, "severity": "" }, { "id": "CVE-2025-38207", "title": "mm: fix uprobe pte be overwritten when expanding vma", "description": "Patch series \"Fix uprobe pte be overwritten when expanding vma\".", "published": "2025-07-04", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38207", "fixed_mainline": "6.16", "cvss": null, "severity": "" }, { "id": "CVE-2025-38284", "title": "wifi: rtw89: pci: configure manual DAC mode via PCI config API only", "description": "To support 36-bit DMA, configure chip proprietary bit via PCI config API or chip DBI interface. However, the PCI device mmap isn't set yet and the DBI is also inaccessible via mmap, so only if the bit can be accessible via PCI config API, chip can support 36-bit DMA. Otherwise, fallback to 32-bit DMA.", "published": "2025-07-10", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38284", "fixed_mainline": "6.16", "cvss": null, "severity": "" }, { "id": "CVE-2025-38605", "title": "wifi: ath12k: Pass ab pointer directly to ath12k_dp_tx_get_encap_type()", "description": "In ath12k_dp_tx_get_encap_type(), the arvif parameter is only used to retrieve the ab pointer. In vdev delete sequence the arvif->ar could become NULL and that would trigger kernel panic. Since the caller ath12k_dp_tx() already has a valid ab pointer, pass it directly to avoid panic and unnecessary dereferencing.", "published": "2025-08-19", "url": "https://www.cve.org/CVERecord?id=CVE-2025-38605", "fixed_mainline": "6.17", "cvss": null, "severity": "" }, { "id": "CVE-2025-39775", "title": "mm/mremap: fix WARN with uffd that has remap events disabled", "description": "Registering userfaultd on a VMA that spans at least one PMD and then mremap()'ing that VMA can trigger a WARN when recovering from a failed page table move due to a page table allocation error.", "published": "2025-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2025-39775", "fixed_mainline": "6.17", "cvss": null, "severity": "" }, { "id": "CVE-2025-40086", "title": "drm/xe: Don't allow evicting of BOs in same VM in array of VM binds", "description": "An array of VM binds can potentially evict other buffer objects (BOs) within the same VM under certain conditions, which may lead to NULL pointer dereferences later in the bind pipeline. To prevent this, clear the allow_res_evict flag in the xe_bo_validate call.", "published": "2025-10-30", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40086", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-40146", "title": "blk-mq: fix potential deadlock while nr_requests grown", "description": "Allocate and free sched_tags while queue is freezed can deadlock[1], this is a long term problem, hence allocate memory before freezing queue and free memory after queue is unfreezed.", "published": "2025-11-12", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40146", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-40197", "title": "media: mc: Clear minor number before put device", "description": "The device minor should not be cleared after the device is released.", "published": "2025-11-12", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40197", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-40217", "title": "pidfs: validate extensible ioctls", "description": "Validate extensible ioctls stricter than we do now.", "published": "2025-12-04", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40217", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-40355", "title": "sysfs: check visibility before changing group attribute ownership", "description": "Since commit 0c17270f9b92 (\"net: sysfs: Implement is_visible for phys_(port_id, port_name, switch_id)\"), __dev_change_net_namespace() can hit WARN_ON() when trying to change owner of a file that isn't visible. See the trace below:", "published": "2025-12-16", "url": "https://www.cve.org/CVERecord?id=CVE-2025-40355", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-68193", "title": "drm/xe/guc: Add devm release action to safely tear down CT", "description": "When a buffer object (BO) is allocated with the XE_BO_FLAG_GGTT_INVALIDATE flag, the driver initiates TLB invalidation requests via the CTB mechanism while releasing the BO. However a premature release of the CTB BO can lead to system crashes, as observed in:", "published": "2025-12-16", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68193", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-68319", "title": "netconsole: Acquire su_mutex before navigating configs hierarchy", "description": "There is a race between operations that iterate over the userdata cg_children list and concurrent add/remove of userdata items through configfs. The update_userdata() function iterates over the nt->userdata_group.cg_children list, and count_extradata_entries() also iterates over this same list to count nodes.", "published": "2025-12-16", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68319", "fixed_mainline": "6.18", "cvss": null, "severity": "" }, { "id": "CVE-2025-68368", "title": "md: init bioset in mddev_init", "description": "IO operations may be needed before md_run(), such as updating metadata after writing sysfs. Without bioset, this triggers a NULL pointer dereference as below:", "published": "2025-12-24", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68368", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2025-68729", "title": "wifi: ath12k: Fix MSDU buffer types handling in RX error path", "description": "Currently, packets received on the REO exception ring from unassociated peers are of MSDU buffer type, while the driver expects link descriptor type packets. These packets are not parsed further due to a return check on packet type in ath12k_hal_desc_reo_parse_err(), but the associated skb is not freed. This may lead to kernel crashes and buffer leaks.", "published": "2025-12-24", "url": "https://www.cve.org/CVERecord?id=CVE-2025-68729", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2025-71117", "title": "block: Remove queue freezing from several sysfs store callbacks", "description": "Freezing the request queue from inside sysfs store callbacks may cause a deadlock in combination with the dm-multipath driver and the queue_if_no_path option. Additionally, freezing the request queue slows down system boot on systems where sysfs attributes are set synchronously.", "published": "2026-01-14", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71117", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2025-71227", "title": "wifi: mac80211: don't WARN for connections on invalid channels", "description": "It's not clear (to me) how exactly syzbot managed to hit this, but it seems conceivable that e.g. regulatory changed and has disabled a channel between scanning (channel is checked to be usable by cfg80211_get_ies_channel_number) and connecting on the channel later.", "published": "2026-02-18", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71227", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2025-71285", "title": "net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels", "description": "MHI stack offers the 'auto_queue' feature, which allows the MHI stack to auto queue the buffers for the RX path (DL channel). Though this feature simplifies the client driver design, it introduces race between the client drivers and the MHI stack. For instance, with auto_queue, the 'dl_callback' for the DL channel may get called before the client driver is fully probed. This means, by the time the", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71285", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-100072", "title": "ACPI: platform: Use acpi_bus_get_primary_device()", "description": "The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1].", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100072", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-100074", "title": "bpf: Mark bpf_refcount field as unique", "description": "BPF_REFCOUNT is not marked as a unique field, while it should be. Fix this oversight.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100074", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-23143", "title": "virtio_net: Fix misalignment bug in struct virtnet_info", "description": "Use the new TRAILING_OVERLAP() helper to fix a misalignment bug along with the following warning:", "published": "2026-02-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23143", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2026-23152", "title": "wifi: mac80211: correctly decode TTLM with default link map", "description": "TID-To-Link Mapping (TTLM) elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped.", "published": "2026-02-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23152", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2026-23208", "title": "ALSA: usb-audio: Prevent excessive number of frames", "description": "In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; When the user performs a write operation to send audio data into the ALSA PCM playback stream, the calculated number of frames is packsize[0] * packets = 264, which exce", "published": "2026-02-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23208", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2026-23259", "title": "io_uring/rw: free potentially allocated iovec on cache put failure", "description": "If a read/write request goes through io_req_rw_cleanup() and has an allocated iovec attached and fails to put to the rw_cache, then it may end up with an unaccounted iovec pointer. Have io_rw_recycle() return whether it recycled the request or not, and use that to gauge whether to free a potential iovec or not.", "published": "2026-03-18", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23259", "fixed_mainline": "6.19", "cvss": null, "severity": "" }, { "id": "CVE-2026-23265", "title": "f2fs: fix to do sanity check on node footer in {read,write}_end_io", "description": "-----------[ cut here ]------------ kernel BUG at fs/f2fs/data.c:358! Call Trace: blk_update_request+0x5eb/0xe70 block/blk-mq.c:987 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1149 blk_complete_reqs block/blk-mq.c:1224 [inline] blk_done_softirq+0x107/0x160 block/blk-mq.c:1229 handle_softirqs+0x283/0x870 kernel/softirq.c:579 __do_softirq kernel/softirq.c:613 [inline] invoke_softirq kernel/sof", "published": "2026-03-18", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23265", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-23371", "title": "sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting", "description": "Running stress-ng --schedpolicy 0 on an RT kernel on a big machine might lead to the following WARNINGs (edited).", "published": "2026-03-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23371", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-23385", "title": "netfilter: nf_tables: clone set on flush only", "description": "Syzbot with fault injection triggered a failing memory allocation with GFP_KERNEL which results in a WARN splat:", "published": "2026-03-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23385", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-23472", "title": "serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN", "description": "uart_write_room() and uart_write() behave inconsistently when xmit_buf is NULL (which happens for PORT_UNKNOWN ports that were never properly initialized):", "published": "2026-04-03", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23472", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-31526", "title": "bpf: Fix exception exit lock checking for subprogs", "description": "process_bpf_exit_full() passes check_lock = !curframe to check_resource_leak(), which is false in cases when bpf_throw() is called from a static subprog. This makes check_resource_leak() to skip validation of active_rcu_locks, active_preempt_locks, and active_irq_id on exception exits from subprogs.", "published": "2026-04-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31526", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-31579", "title": "wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit", "description": "wg_netns_pre_exit() manually acquires rtnl_lock() inside the pernet .pre_exit callback. This causes a hung task when another thread holds rtnl_mutex - the cleanup_net workqueue (or the setup_net failure rollback path) blocks indefinitely in wg_netns_pre_exit() waiting to acquire the lock.", "published": "2026-04-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31579", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-31591", "title": "KVM: SEV: Lock all vCPUs when synchronzing VMSAs for SNP launch finish", "description": "Lock all vCPUs when synchronizing and encrypting VMSAs for SNP guests, as allowing userspace to manipulate and/or run a vCPU while its state is being synchronized would at best corrupt vCPU state, and at worst crash the host kernel.", "published": "2026-04-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31591", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-31592", "title": "KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock", "description": "Take and hold kvm->lock for before checking sev_guest() in sev_mem_enc_register_region(), as sev_guest() isn't stable unless kvm->lock is held (or KVM can guarantee KVM_SEV_INIT{2} has completed and can't rollack state). If KVM_SEV_INIT{2} fails, KVM can end up trying to add to a not-yet-initialized sev->regions_list, e.g. triggering a #GP", "published": "2026-04-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31592", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-31692", "title": "rtnetlink: add missing netlink_ns_capable() check for peer netns", "description": "rtnl_newlink() lacks a CAP_NET_ADMIN capability check on the peer network namespace when creating paired devices (veth, vxcan, netkit). This allows an unprivileged user with a user namespace to create interfaces in arbitrary network namespaces, including init_net.", "published": "2026-04-30", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31692", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43022", "title": "Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists", "description": "hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources.", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43022", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43034", "title": "bnxt_en: set backing store type from query type", "description": "bnxt_hwrm_func_backing_store_qcaps_v2() stores resp->type from the firmware response in ctxm->type and later uses that value to index fixed backing-store metadata arrays such as ctx_arr[] and bnxt_bstore_to_trace[].", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43034", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43053", "title": "xfs: close crash window in attr dabtree inactivation", "description": "When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the roo", "published": "2026-05-01", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43053", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43118", "title": "btrfs: fix zero size inode with non-zero size after log replay", "description": "When logging that an inode exists, as part of logging a new name or logging new dir entries for a directory, we always set the generation of the logged inode item to 0. This is to signal during log replay (in overwrite_item()), that we should not set the i_size since we only logged that an inode exists, so the i_size of the inode in the subvolume tree must be preserved (as when we log new names or", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43118", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43127", "title": "ntfs3: fix circular locking dependency in run_unpack_ex", "description": "Syzbot reported a circular locking dependency between wnd->rw_lock (sbi->used.bitmap) and ni->file.run_lock.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43127", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43272", "title": "ring-buffer: Fix possible dereference of uninitialized pointer", "description": "There is a pointer head_page in rb_meta_validate_events() which is not initialized at the beginning of a function. This pointer can be dereferenced if there is a failure during reader page validation. In this case the control is passed to \"invalid\" label where the pointer is dereferenced in a loop.", "published": "2026-05-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43272", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43298", "title": "drm/amdgpu: Skip vcn poison irq release on VF", "description": "VF doesn't enable VCN poison irq in VCNv2.5. Skip releasing it and avoid call trace during deinitialization.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43298", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43299", "title": "btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()", "description": "[BUG] There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO (this part is expected, although the ENOSPC bug still needs to be addressed).", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43299", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43308", "title": "btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()", "description": "There is no need to BUG(), we can just return an error and log an error message.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43308", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43309", "title": "md raid: fix hang when stopping arrays with metadata through dm-raid", "description": "When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43309", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43325", "title": "wifi: iwlwifi: mvm: don't send a 6E related command when not supported", "description": "MCC_ALLOWED_AP_TYPE_CMD is related to 6E support. Do not send it if the device doesn't support 6E. Apparently, the firmware is mistakenly advertising support for this command even on AX201 which does not support 6E and then the firmware crashes.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43325", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43326", "title": "sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback", "description": "SCX_KICK_WAIT busy-waits in kick_cpus_irq_workfn() using smp_cond_load_acquire() until the target CPU's kick_sync advances. Because the irq_work runs in hardirq context, the waiting CPU cannot reschedule and its own kick_sync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock.", "published": "2026-05-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43326", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-45934", "title": "btrfs: fix EEXIST abort due to non-consecutive gaps in chunk allocation", "description": "I have been observing a number of systems aborting at insert_dev_extents() in btrfs_create_pending_block_groups(). The following is a sample stack trace of such an abort coming from forced chunk allocation (typically behind CONFIG_BTRFS_EXPERIMENTAL) but this can theoretically happen to any DUP chunk allocation.", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45934", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-46014", "title": "KVM: SVM: Add missing save/restore handling of LBR MSRs", "description": "MSR_IA32_DEBUGCTLMSR and LBR MSRs are currently not enumerated by KVM_GET_MSR_INDEX_LIST, and LBR MSRs cannot be set with KVM_SET_MSRS. So save/restore is completely broken.", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46014", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46017", "title": "mm: fix deferred split queue races during migration", "description": "migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio().", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46032", "title": "KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT", "description": "If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exception", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46032", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46059", "title": "KVM: nSVM: Always use NextRIP as vmcb02's NextRIP after first L2 VMRUN", "description": "For guests with NRIPS disabled, L1 does not provide NextRIP when running an L2 with an injected soft interrupt, instead it advances the current RIP before running it. KVM uses the current RIP as the NextRIP in vmcb02 to emulate a CPU without NRIPS.", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46059", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46071", "title": "KVM: nSVM: Avoid clearing VMCB_LBR in vmcb12", "description": "svm_copy_lbrs() always marks VMCB_LBR dirty in the destination VMCB. However, nested_svm_vmexit() uses it to copy LBRs to vmcb12, and clearing clean bits in vmcb12 is not architecturally defined.", "published": "2026-05-27", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46071", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46153", "title": "8021q: delete cleared egress QoS mappings", "description": "vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory.", "published": "2026-05-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46153", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46279", "title": "mm/alloc_tag: clear codetag for pages allocated before page_ext initialization", "description": "Due to initialization ordering, page_ext is allocated and initialized relatively late during boot. Some pages have already been allocated and freed before page_ext becomes available, leaving their codetag uninitialized.", "published": "2026-06-08", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46279", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-52994", "title": "vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting", "description": "virtio_transport_init_zcopy_skb() uses iter->count as the size argument for msg_zerocopy_realloc(), which in turn passes it to mm_account_pinned_pages() for RLIMIT_MEMLOCK accounting. However, this function is called after virtio_transport_fill_skb() has already consumed the iterator via __zerocopy_sg_from_iter(), so on the last skb, iter->count will be 0, skipping the RLIMIT_MEMLOCK enforcement.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52994", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53017", "title": "f2fs: fix data loss caused by incorrect use of nat_entry flag", "description": "Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows:", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53018", "title": "f2fs: avoid reading already updated pages during GC", "description": "We found the following issue during fuzz testing:", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53018", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53103", "title": "wifi: mt76: mt7925: fix potential deadlock in mt7925_roc_abort_sync", "description": "roc_abort_sync() can deadlock with roc_work(). roc_work() holds dev->mt76.mutex, while cancel_work_sync() waits for roc_work() to finish. If the caller already owns the same mutex, both sides block and no progress is possible.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53103", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53104", "title": "wifi: mt76: Fix memory leak destroying device", "description": "All MT76 rx queues have an associated page_pool even if the queue is not associated to a NAPI (e.g. WED RRO queues with WED enabled). Destroy the page_pool running mt76_dma_cleanup routine during module unload. Moreover returns pages to the page pool if WED is not enabled for WED RRO queues.", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53104", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53106", "title": "bpf: Do not allow deleting local storage in NMI", "description": "Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation req", "published": "2026-06-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53106", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53258", "title": "wifi: fix leak if split 6 GHz scanning fails", "description": "rdev->int_scan_req is leaked if cfg80211_scan() fails. Note that it's supposed to be released at ___cfg80211_scan_done() but this doesn't happen as rdev->scan_req is NULL at that point, too, leading to the early return from the freeing function.", "published": "2026-06-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53258", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53321", "title": "io_uring/napi: cap busy_poll_to 10 msec", "description": "Currently there's no cap on the maximum amount of time that napi is allowed to poll if no events are found, which can lead to kernel complaints on a task being stuck as there's no conditional rescheduling done within that loop.", "published": "2026-06-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53321", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-63811", "title": "f2fs: read COW data with the original inode during atomic write", "description": "When updating an atomic-write file, f2fs_write_begin() may read the previously written data back from the COW inode: prepare_atomic_write_begin() locates the block in the COW inode and sets use_cow, and the read bio is then built with the COW inode:", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63811", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-63998", "title": "ethtool: module: call ethnl_ops_complete() on module flash errors", "description": "When validate() fails we are skipping over ethnl_ops_complete() even tho we already called ethnl_ops_begin().", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63998", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-63999", "title": "ethtool: rss: fix indir_table and hkey leak on get_rxfh failure", "description": "rss_prepare_get() allocates the indirection table and hash key buffer via rss_get_data_alloc(), then calls ops->get_rxfh() to populate them. If get_rxfh() fails, the function returns an error without freeing the allocation.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63999", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64006", "title": "netfilter: nf_tables: fix dst corruption in same register operation", "description": "For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then immediately reads from src to calculate the carry for the next iteration. Because src and dst could point to the same memory location, the carry is incorrectly calculated using the newly modified dst value instead of the original src value.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64006", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64060", "title": "netfs: Fix leak of request in netfs_write_begin() error handling", "description": "Fix netfs_write_begin() to not leak our ref on the request in the event that we get an error from netfs_wait_for_read().", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64060", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64079", "title": "netfilter: x_tables: allocate hook ops while under mutex", "description": "arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL.", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64079", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64159", "title": "netfs: Fix zeropoint update where i_size > remote_i_size", "description": "Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_", "published": "2026-07-19", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64159", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64513", "title": "KVM: x86: Unconditionally recompute CR8 intercept on PPR update", "description": "The TPR_THRESHOLD field in the VMCS is used by VMX to induce VM exits when the guest's virtual TPR falls under the specified threshold, allowing KVM to inject previously masked interrupts.", "published": "2026-07-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64513", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68086", "title": "mm/khugepaged: write all dirty file folios when collapsing", "description": "[There is no upstream commit, as this code was removed by upstream commit 044925f9b565 (\"mm: fs: remove filemap_nr_thps*() functions and their users\")]", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68086", "fixed_mainline": "", "cvss": null, "severity": "" }, { "id": "CVE-2026-68105", "title": "drm/amdgpu: Fix kernel panic during driver load failure", "description": "Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68105", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68238", "title": "drm/amdgpu: Release VFCT ACPI table reference", "description": "amdgpu_acpi_vfct_bios() fetches the VFCT table with acpi_get_table() but never releases it. acpi_get_table() takes a reference on the table (incrementing its validation_count and mapping it on the 0->1 transition); without a paired acpi_put_table() the mapping is leaked on every call, whether or not a matching VBIOS image is found.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68238", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68241", "title": "drm/i915/mst: limit DP MST ESI service loop", "description": "The loop in intel_dp_check_mst_status() keeps servicing interrupts originating from the sink without bound. Add an upper bound to the new interrupts occurring during interrupt processing to not get stuck on potentially stuck sink devices. Use arbitrary 32 tries to clear incoming interrupts in one go.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68241", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68242", "title": "drm/i915/gt: Fix NULL deref on sched_engine alloc failure", "description": "Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68242", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68375", "title": "bnxt_en: Handle partially initialized auxiliary devices", "description": "bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68412", "title": "wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()", "description": "If the test against IEEE80211_MAX_SSID_LEN fails, then 'creq' leaks. Use the existing error handling path to fix it.", "published": "2026-08-10", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68412", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68441", "title": "net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains", "description": "When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected.", "published": "2026-08-12", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68441", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68448", "title": "ovl: check access to copy_file_range source with src mounter creds", "description": "Commit 5dae222a5ff0c (\"vfs: allow copy_file_range to copy across devices\") allowed filesystems that implement the copy_file_range() f_op to decide if they want to access cross-sb copy from/to the same fs type.", "published": "2026-08-12", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68448", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72031", "title": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD", "description": "The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72031", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72321", "title": "ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()", "description": "When a timer is deleted and not re-armed in igmp_mod_timer(), or stopped in igmp_stop_timer(), the code currently decrements the reference counter of the multicast list entry @im using refcount_dec(&im->refcnt).", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72321", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72365", "title": "netfs: Fix writethrough to use collection offload", "description": "Fix writethrough write to set NETFS_RREQ_OFFLOAD_COLLECTION on the request so that collection is processed asynchronously rather than only right at the end - and also so that asynchronous O_SYNC writes get collected at all.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72365", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74261", "title": "ALSA: seq: avoid stale FIFO cells during resize", "description": "snd_seq_fifo_resize() still needs to publish the replacement pool before it waits for FIFO users. A blocking snd_seq_read() holds f->use_lock while it sleeps, so concurrent senders must be able to queue to the new pool and wake that reader instead of failing against a closing old pool.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74261", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74337", "title": "bpf: Fix NMI/tracepoint re-entry deadlock on lru locks", "description": "NMI and tracepoint BPF programs can re-enter the per-CPU or global LRU lock that bpf_lru_pop_free()/push_free() already hold on the same CPU, AA-deadlocking. Lockdep reports \"inconsistent {INITIAL USE} -> {IN-NMI}\" on &l->lock (syzbot c69a0a2c816716f1e0d5) and \"possible recursive locking detected\" on &loc_l->lock (syzbot 18b26edb69b2e19f3b33).", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74337", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74342", "title": "kernfs: link kn to its parent before the LSM init hook", "description": "After commit 12e9e3cd03b5 (\"simpe_xattr: use per-sb cache\"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74342", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74375", "title": "md/raid1,raid10: fix deadlock in read error recovery path", "description": "raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended before md_handle_request() acquires an active_io reference via percpu_ref_tryget_live().", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74542", "title": "netfs: Fix folio_queue ENOMEM in writeback by adding a mempool", "description": "Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74542", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74558", "title": "xsk: reclaim invalid Tx descriptors in ZC batch path", "description": "The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74558", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74559", "title": "xsk: drain continuation descs after overflow in xsk_build_skb()", "description": "Fix generic xmit path multi-buffer logic when packets are either too big (count of descriptors exceed MAX_SKB_FRAGS) or an invalid descriptor is included in fragmented packet. Introduce xdp_sock::drain_cont and act upon this flag - when it is set, keep on consuming descriptors from AF_XDP Tx ring and put them directly onto Cq. Previously these descriptors were silently lost and could never be reac", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74559", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74560", "title": "xsk: fix buffer leak in xsk_drop_skb() for AF_XDP multi-buffer Tx", "description": "This patch is inspired by the check[1] from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the whole process of publishing the address of cq in this particular case is not right: it should truely publish the address and advance the cached_prod in cq as long as it reads descriptors from txq.", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74560", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74571", "title": "btrfs: skip global block reserve accounting for rescue mounts", "description": "[BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:", "published": "2026-08-15", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74571", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74600", "title": "mm/page_table_check: skip special zero mappings", "description": "page_table_check_set() and page_table_check_clear() account mappings based on PageAnon(). Shared zero-page PTEs and huge zero PMDs are special mappings, but page_table_check can still account them as file-backed pages.", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74600", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74728", "title": "xfs: handle NULL b_addr in xfs_buf_free", "description": "When xfs_buf_alloc_backing_mem() fails, xfs_buf_free() is called with bp->b_addr still NULL. The code falls through to the folio_put path which calls virt_to_folio(NULL), dereferencing an invalid address and causing a kernel crash.", "published": "2026-08-22", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74728", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74754", "title": "scsi: core: pair EH runtime PM get and put", "description": "shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host().", "published": "2026-08-26", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74754", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80607", "title": "tracing/probes: Remove WARN_ON_ONCE from parse_btf_arg", "description": "Sashiko found that user can cause this WARN_ON_ONCE() easily with adding a kprobe event based on a raw address with BTF parameter.", "published": "2026-08-28", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80607", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80761", "title": "Bluetooth: ISO: zero the sockaddr before returning it in getname", "description": "iso_sock_getname() fills a struct sockaddr_iso in place and returns its size without clearing it first, so bytes it does not write are copied to user space from the kernel stack. The getsockname(2) and getpeername(2) paths both run through do_getsockname(), which hands getname() an uninitialized sockaddr_storage on the stack and copies back up to the number of bytes getname() returns, so the drive", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80761", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-80785", "title": "fbdev: serialize mode sysfs access with lock_fb_info()", "description": "show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one.", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80785", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80786", "title": "fbdev: Wrap user-invoked calls to fb_set_var() in helper", "description": "Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.", "published": "2026-09-04", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80786", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80920", "title": "io_uring: defer eventfd signaling when queued from a wakeup handler", "description": "io_req_local_work_add() signals the CQ ring eventfd inline when it is the one to push the first entry onto ->work_list. For DEFER_TASKRUN rings that add is frequently done from a waitqueue wakeup handler, where an arbitrary waitqueue lock is held.", "published": "2026-09-09", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80920", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-80948", "title": "wifi: iwlwifi: dvm: fix memory leak in iwl_op_mode_dvm_start()", "description": "In iwl_op_mode_dvm_start(), jumping to out_free_eeprom currently bypasses the out_free_eeprom_blob label. Consequently, error paths triggered after successfully parsing the EEPROM free priv->nvm_data but leak priv->eeprom_blob.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80948", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89722", "title": "PCI/sysfs: Fix out-of-bounds read in pci_write_legacy_io()", "description": "pci_write_legacy_io() loads 4 bytes from the kernfs write buffer regardless of how many bytes userspace wrote:", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89722", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89757", "title": "mm/mglru: fix and remove redundant unevictable folio handling", "description": "sort_folio() has a shortcut for moving folios that are no longer evictable but are still sitting on a generation list. However, this shortcut is buggy. It does not follow the PG_lru usage convention, and it has a more serious issue.", "published": "2026-09-11", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89757", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89812", "title": "drm/amdgpu: force complete the MES ring fences on reset", "description": "The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1 reset, while fence_drv.sync_seq keeps advancing for every packet.", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89812", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89813", "title": "drm/amdgpu: force complete the KIQ ring fences on reset", "description": "Like the MES scheduler ring, the KIQ ring sets no_scheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its hw fence value lives in wb (GTT) memory and survives a MODE1 reset while fence_drv.sync_seq keeps advancing, so after a reset the first KIQ submission can poll forever on a seq that is never written back.", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89813", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89833", "title": "f2fs: fix to avoid potential deadloop in f2fs_fsync_node_pages()", "description": "There is potential deadloop in race condition:", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89833", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89987", "title": "mm/huge_memory: transfer the pmd dirty bit to the folio on zap", "description": "zap_huge_pmd_folio() propagates the pmd young bit to the folio for the file case, but not the dirty bit. The pte path does propagate it, in zap_present_folio_ptes() and so does the pmd split path, in __split_huge_pmd_locked().", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89987", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90040", "title": "KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped", "description": "Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core logic to handle invalidations as VMX does for the APIC-access page, as the two concepts are nearly identical: shove the physical address of a page into the vCPU's control structure:", "published": "2026-09-16", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90040", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90061", "title": "netfilter: nf_tables: skip double clone set expressions on element insert", "description": "Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuratio", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90061", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90086", "title": "xsk: honor XDP_TX_METADATA in zero-copy path", "description": "The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDP_TX_METADATA. Pass descriptor options through the metadata helpers and ignore metadata unless the option is set.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90086", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90087", "title": "Bluetooth: do not leak an hci_conn when a second LE connect is rejected", "description": "create_le_conn_complete() decides whether the failed connection is still pending by comparing it against hci_lookup_le_connect(), which returns the first LE connection in BT_CONNECT. That is the same connection only while at most one is pending.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90087", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90097", "title": "Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition", "description": "The VMBus module initialization function, hv_acpi_init(), currently does nothing when running in the root partition and root is not nested in another VM. But the initialization function reports success, so the VMBus module is indeed loaded. VMBus functionality is not actually needed, but the VMBus module must be loaded so that hv_vmbus_exists() can answer correctly. Furthermore, the mshv_root depe", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90097", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90099", "title": "net/sched: account classifier filter allocations to memcg", "description": "Allocations in the tc classifier *_change() paths (filter objects, per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without __GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside memcg charging. The shared tcf_exts_init_ex() action array allocation in cls_api.c was also uncharged; this patch closes it along with the per-classifier filter-object/percpu/aux allocation", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90106", "title": "net: bridge: arp/nd proxy: fix reading neigh ha", "description": "Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90106", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90182", "title": "blk-iocost: clear delay state when freeing policy data", "description": "iocg_kick_delay() turns sufficiently large debt into an explicit block-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to -1 and incrementing blkcg->congestion_count. Clearing it again depends on iocg_kick_delay() running from the period timer, the waitq timer or the issue path.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90182", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90183", "title": "blk-iolatency: clear delay state when freeing policy data", "description": "io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90183", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90247", "title": "bpf: Fix mmap_lock leak in irq_work path", "description": "stack_map_get_build_id_offset() introduced a per-CPU irq_work to defer mmap_read_unlock() from NMI context, and bpf_find_vma() later reused the same mmap_unlock_work. Both callers only check whether the work is busy before taking mmap_lock, so a nested caller can reuse the slot before the first caller queues it. Two read locks may then be acquired while only one deferred unlock runs, leaking a rea", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90247", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90259", "title": "btrfs: qgroup: fix a wrong length calculation in qgroup_free_reserved_data()", "description": "In that function, we round down the start position and round up the ending position.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90259", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90261", "title": "btrfs: zoned: flush active metadata block group at btree_writepages() start", "description": "btree_writepages() writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block group is active for writing at a time, and check_bg_is_active() (via btrfs_check_meta_write_pointer()) pivots the active block group as writeback moves from one block group to the next.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90261", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90263", "title": "btrfs: check if root is readonly when setting posix acl", "description": "For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs ro property is true.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90263", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90264", "title": "btrfs: always wait for ordered extents to avoid OE races", "description": "[BUG] Syzbot reported a bug that there can be conflicting OEs for the same range:", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90264", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90265", "title": "btrfs: defrag: fix deadlock between defrag and delalloc space reservation", "description": "While running fsstress with autodefrag and flushoncommit, hit a deadlock due to the fact that defrag reserves delalloc space while it's holding dirty and locked folios, besides the extent range lock. The stack traces are the following:", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90265", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90267", "title": "scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails", "description": "sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90267", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90300", "title": "bpf: Clear buf on error in __bpf_get_task_stack", "description": "Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90300", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90311", "title": "thermal: hwmon: Remove hwmon class device along with its parent", "description": "The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90311", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90315", "title": "PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "description": "Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90315", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90335", "title": "tty: skip cdev_del() when no cdev is registered", "description": "TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer dereference.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90335", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90336", "title": "serial: core: clear freed pointers on uart_register_driver() failure", "description": "uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90336", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90337", "title": "serial: core: do fallible allocations before the console can be registered", "description": "serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90337", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90345", "title": "wifi: brcmfmac: fix P2P action frame handling without device vif", "description": "Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary interface, or when action-frame abort runs after the P2P device vif has not been created.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90345", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90346", "title": "wifi: nl80211: clean up color-change beacon data on errors", "description": "nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90346", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90359", "title": "bpf: Reject >8 byte return values on return-reading trampoline paths", "description": "btf_distill_func_proto() builds the function model used for the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has accepted a 16-byte __int128 return value since the trampoline was introduced: __get_type_size() returns the integer's type size, and the return-type check only rejected ret < 0.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90359", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90421", "title": "PCI: Fix UAF when probe runs concurrent to dyn ID removal", "description": "Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90421", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92499", "title": "ext4: validate readdir offset before accessing dirent", "description": "A corrupted directory can trigger the following KASAN report when ext4_readdir() resumes from an invalid position:", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92499", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92500", "title": "ext4: use fsdata to track inline data write state and fix race", "description": "Instead of checking the live inode state (ext4_has_inline_data(inode) and ext4_test_inode_state(inode, EXT4_STATE_MAY_INLINE_DATA)) in the write_end handlers, use the fsdata parameter of the address space operations to explicitly pass down the state in which write_begin prepared the write.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92500", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92503", "title": "ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()", "description": "Syzbot/stress-ng reported an ABBA deadlock in ext4 when exercising concurrent xattr workloads (using the ea_inode mount/format option).", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92503", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92520", "title": "bpf: Zero queue and stack outputs on lock failure", "description": "Queue and stack pop/peek helpers accept an uninitialized output buffer because the verifier expects the helper to initialize it. The empty-map error path clears the buffer, but a failed lock acquisition returns -EBUSY without writing it.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92520", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93044", "title": "bpf: Disallow interpreter fallback for arena-related insns", "description": "Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::__bpf_prog_select_runtime().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93044", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93129", "title": "platform/x86: dell-wmi-base: Fix handling of ultra performance key", "description": "The commit message of commit 5fbd827eb9c2 (\"platform/x86: dell-wmi: Recognise or support new switches\") states that the ultra performance key contains additional data after the type and code fields. The event data passed to dell_wmi_process_key() is already parsed, so \"buffer\" already starts after those two fields.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93129", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93146", "title": "time/namespace: Validate nanosecond field in proc_timens_set_offset()", "description": "The function validates tv_sec to be within [-KTIME_SEC_MAX, KTIME_SEC_MAX] but never validates that tv_nsec is within the valid range of [0, NSEC_PER_SEC-1] before using it in timespec64_add().", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93146", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93181", "title": "perf/x86/intel/uncore: Fix uncore_box ref/unref ordering", "description": "In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case.", "published": "2026-09-17", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93181", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93230", "title": "mm/hugetlb: initialize gigantic bootmem hugepage struct pages earlier", "description": "Gigantic bootmem HugeTLB pages are currently initialized from hugetlb_init(), but page_alloc_init_late() runs earlier and walks pageblocks to determine zone contiguity.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93230", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93243", "title": "mm/secretmem: properly account locked pages", "description": "secretmem accounts folios by treating memory as if it were mlock()'d and thus limited by the RLIMIT_MEMLOCK limit.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93243", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93251", "title": "ACPI: bus: Introduce acpi_bus_get_primary_device()", "description": "The function used for obtaining the first \"physical\" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node(), may return a stale device pointer (mostly in theory) because acpi_unbind_one() may run as a whole after dropping the ACPI device's physical_node_lock in acpi_get_first_physical_node() and before it returns. The last reference to the \"physical\" device may b", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93251", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93270", "title": "bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn", "description": "The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + '.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93270", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97424", "title": "drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq", "description": "cp_ecc_error_irq is acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(), so the put site has to query amdgpu_irq_enabled() because the get is skipped on SR-IOV VF.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97424", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-97432", "title": "wifi: iwlwifi: mvm: fix P2P-Device binding handling", "description": "Our binding handling for P2P-Device can run into the following scenario, as observed by our testing:", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97432", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-97479", "title": "driver core: Avoid warning when removing a device while its supplier is unbinding", "description": "During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 __device_links_no_driver+0xcc/0xfc ... Call trace: __device_links_no_driver+0xcc/0xfc (P) device_links_driver_cleanup+0xa8/0xf0 device_release_driver_internal+0x208/0x23c device_links_unbind_consumers+0xe0/0x108 device_release_driver_internal+0xec/0x23c device_links_unbind_consumers+0xe0/0", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97479", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-97480", "title": "tty: serial: 8250: protect against NULL uart->port.dev in register", "description": "serial8250_register_8250_port() conditionally copies uart->port.dev from up->port.dev only when up->port.dev is non-NULL:", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97480", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-97493", "title": "drm/amdgpu: Bound GPIO I2C table entry count from VBIOS", "description": "Reject undersized tables and cap the derived entry count to AMDGPU_MAX_I2C_BUS so we do not overrun adev->i2c_bus[] or walk an absurd number of entries on corrupt size fields.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97493", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-97503", "title": "genirq/proc: Size interrupt directory names for 10-digit interrupt numbers", "description": "/proc/irq// directory names are built in `char name[10]` buffers with `sprintf(name, \"%u\", irq)`.", "published": "2026-09-24", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97503", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-97928", "title": "drm/amdgpu: skip the VMID 0 flush for VRAM", "description": "Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA flush can wedge the engine; only flush when a GART window is actually used.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97928", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97960", "title": "perf/x86/intel: Prevent drain_pebs() reentry", "description": "The PEBS buffer is shared by all events on a CPU, so drain_pebs() must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97960", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97975", "title": "Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()", "description": "A NULL pointer dereference in klist_put() occurs when a child device (such as a BNEP network device in bnep_session) is concurrently being unregistered while hci_conn_del_sysfs() reparents child devices.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97975", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97997", "title": "virtio_ring: fix stale descriptor flags after a failed packed add", "description": "In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every round of the ring, tracked by a wrap counter, so invalidating or validating a descriptor means inverting both bits.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97997", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98003", "title": "iommu/amd: Do not reallocate GA log buffers on resume", "description": "Commit c5e1a1eb9279 (\"iommu/amd: Simplify and Consolidate Virtual APIC (AVIC) Enablement\") moved the GA log allocation from iommu_init_pci() to enable_iommus_vapic(), which is called on every resume.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98003", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98019", "title": "bpf: mark a NULL call argument precise", "description": "check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98019", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98032", "title": "tracing: Fix subbuf resize races with trace_pipe_raw readers", "description": "Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98032", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98033", "title": "bpf: Preserve inner map identity in callback frames", "description": "Callback frame constructors initialize map-typed argument registers with __mark_reg_known_zero() and then restore map_ptr. This clears map_uid, which is the only field distinguishing inner maps that share an inner_map_meta template.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98033", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98034", "title": "bpf: Mark NULL kptr stores precise", "description": "check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98034", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98038", "title": "bpf: Keep refcount_acquire nullable for borrowed RCU kptrs", "description": "bpf_refcount_acquire() is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF_RET_NULL on the return value unless the argument is an owning reference.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98038", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98043", "title": "bpf: Don't infer non-NULL from a pointer with an unbounded offset", "description": "reg_not_null() decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL base, in case of an unbound offset the runtime offset value might still add up to NULL. Consider the followng program:", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98043", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98044", "title": "bpf: Reject legacy packet loads from callbacks", "description": "check_ld_abs() models a failed BPF_LD_ABS or BPF_LD_IND in a subprogram as an implicit return with R0 set to zero. It calls prepare_func_exit() to explore this synthesized path.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98044", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98047", "title": "bpf: Check ancestor frames for rbtree callbacks", "description": "bpf_rbtree_add() invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibits unlocking, consuming tree nodes, or changing RCU state from that callback.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98047", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98048", "title": "bpf: don't rewrite bpf_fastcall patterns entered by a jump", "description": "mark_fastcall_pattern_for_call() must ensure that matched \"spill; call; fill\" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98048", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98058", "title": "bpf: Mark syscall helpers as sleepable", "description": "bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98058", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98062", "title": "bpf: Mark signal tracepoint siginfo arguments as scalar", "description": "The signal_generate and signal_deliver tracepoints declare their info argument as a struct kernel_siginfo pointer. btf_ctx_access() therefore treats it as a trusted pointer for tp_btf programs.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98062", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98079", "title": "btrfs: zstd: fix lost wakeup when waiting for a workspace", "description": "A writer can sleep forever in zstd_get_workspace() even though a workspace is free. When zstd_alloc_workspace() fails, the task is queued on zwsm->wait and schedules unconditionally, never re-testing the pool. zstd_put_workspace() publishes the workspace and then calls cond_wake_up(), which only wakes when a sleeper is already visible, so a workspace returned between the failed allocation and prep", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98079", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98087", "title": "sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate", "description": "A migrate_disable()'d RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list (rq->rt.pushable_tasks) and still marks the runqueue RT-overloaded (rq->rt.overloaded = 1). So the RT balancer keeps treating this CPU as having a task to move away, and keeps trying to move the task, but the push can never succeed. When the head is pinned, push_rt_ta", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98087", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98099", "title": "ipv6: mcast: use rcu_assign_pointer() for __rcu list updates", "description": "Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98118", "title": "netfs: Fix readahead synchronisation issues by loading all folios upfront", "description": "There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at them or trying to clear them, such as determining the setting of front_folio_order when the next folio hasn't been added yet,", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98118", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98119", "title": "netfs: break unbuffered write when netfs_alloc_subrequest() fails", "description": "syzbot reported a null-ptr-deref below [1] following a fault injection in netfs_alloc_subrequest(). [0]", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98119", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98134", "title": "bpf: check_cond_jmp_op(): properly infer if register is null", "description": "Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example:", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98134", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98147", "title": "printk: Don't WARN on kthread_run failure.", "description": "Since __kthread_create_on_node() returns -EINTR upon SIGKILL, we should not use WARN_ON() in order to catch kthread_run() failure.", "published": "2026-09-25", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98147", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98273", "title": "x86/kprobes: Fix crash when probing CS CALL instructions", "description": "When using eBPF to probe CS CALL instructions within a function, a crash can be triggered.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98273", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98279", "title": "btrfs: handle lack of space when cleaning up verity items", "description": "When enable_verity() hits the qgroup limit, rollback_verity() needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesystem is forced read-only even though the qgroup limit was for one subvolume only. Also orphan cleanup at the next mount fails the same way, so the leftover items are never removed: with -EDQUOT the subvolume stays unreachable", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98279", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98284", "title": "netlink: do not free nlk->groups while lockless readers can use it", "description": "netlink_realloc_groups() uses krealloc() under netlink_table_grab(). Whenever NLGRPSZ(groups) lands in a different kmalloc bucket, the old bitmap is freed immediately.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98284", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98289", "title": "af_unix: Unify scc_index when finalising SCC in __unix_walk_scc().", "description": "Commit bfdb01283ee8 (\"af_unix: Assign a unique index to SCC.\") changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint (unix_vertex.scc_index).", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98289", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98296", "title": "Bluetooth: btintel_pcie: validate TX skb length in send_sync", "description": "btintel_pcie_prepare_tx() copies skb->len bytes into a fixed BTINTEL_PCIE_BUFFER_SIZE (4096) DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in btintel_pcie_send_frame(); any future caller of btintel_pcie_send_sync() would silently overflow the DMA buffer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98296", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98317", "title": "neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.", "description": "NDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses .validation_type, so no validation is applied:", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98317", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98321", "title": "netfilter: nf_nat: unregister and release hooks on error", "description": "If nf_hook_entries_insert_raw() fails, the NAT hooks get never released, resulting in a memleak.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98321", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98332", "title": "wifi: mac80211: only operate on TDLS peers in the TDLS code", "description": "ieee80211_tdls_oper() can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused for a TDLS peer.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98332", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98333", "title": "wifi: mac80211: reset the LED state when ifup fails", "description": "When the first interface comes up, the radio LED is turned on. This can start the TPT trigger timer, which continues running.", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98333", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98338", "title": "wifi: cfg80211: ibss: ref BSS entry for joined event", "description": "When the IBSS is joined, we only record the BSSID/channel in the event and look up the BSS entry when processing it. However, that's racy, e.g. a new scan with NL80211_SCAN_FLAG_FLUSH can remove it, causing a warning in the event work:", "published": "2026-10-06", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98338", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98375", "title": "xen/netfront: drop RX packets with a short Ethernet header", "description": "handle_incoming_queue() pulls pull_to bytes into the head before calling eth_type_trans(). pull_to is the length of the first RX slot, capped at RX_COPY_THRESHOLD, and that length comes from the backend. Nothing checks it against ETH_HLEN.", "published": "2026-10-09", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98375", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98376", "title": "bpf: Use array_map_meta_equal for percpu array inner map replacement", "description": "percpu_array_map_ops.map_meta_equal points to the generic bpf_map_meta_equal(), which does not compare max_entries. When a percpu array serves as an inner map, replacing it with one that has fewer max_entries bypasses the check. Since percpu_array_map_gen_lookup() inlines the original template's index_mask as a JIT immediate, a lookup on the replacement map can access pptrs[] out of bounds.", "published": "2026-10-09", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98376", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-98393", "title": "net: ipv4: Fix UDP length overflow with PMTU discover and big MTU", "description": "This commit bounds cork->base.fragsize to IP_MAX_MTU to avoid a possible overflow of UDP length that triggers a WARN in udp_set_len_short when setsockopt IP_MTU_DISCOVER is set to IP_PMTUDISC_PROBE, and a large packet is sent over a netdev with an unusually large MTU.", "published": "2026-10-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98393", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98424", "title": "wifi: cfg80211: undo netns switch if renaming the wiphy fails", "description": "Once all the interfaces have been moved, cfg80211_switch_netns() moves the wiphy itself by setting its network namespace and then renaming it, which makes sysfs move it. The rename can fail (but only on allocation failures), leaving things mixed up and hitting the warning there.", "published": "2026-10-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98424", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98427", "title": "net/sched: codel: bound the dropping loop per dequeue call", "description": "The CoDel control law schedules the next drop one interval/sqrt(count) after the previous drop, using the configured interval (codel_params.interval). For very small intervals the scheduled step rounds down to zero, so the dropping loop in codel_dequeue() never advances and drains the entire backlog under the qdisc lock in one call - an unprivileged user can trigger a soft lockup this way.", "published": "2026-10-14", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98427", "fixed_mainline": "7.3", "cvss": null, "severity": "" } ], "filtered": true, "not_built": 388, "update_to": "" } ] }