{ "timestamp": "2026-09-27T12:54:36Z", "kernels": [ { "version": "6.18.54", "update": [], "unfixed": [ { "id": "CVE-2026-72493", "title": "net: serialize netif_running() check in enqueue_to_backlog()", "description": "Syzbot reported a KASAN slab-use-after-free in fib_rules_lookup().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72493", "fixed_mainline": "7.2", "cvss": 9.9, "severity": "CRITICAL" }, { "id": "CVE-2026-31501", "title": "net: ti: icssg-prueth: fix use-after-free of CPPI descriptor in RX path", "description": "cppi5_hdesc_get_psdata() returns a pointer into the CPPI descriptor. In both emac_rx_packet() and emac_rx_packet_zc(), the descriptor is freed via k3_cppi_desc_pool_free() before the psdata pointer is used by emac_rx_timestamp(), which dereferences psdata[0] and psdata[1]. This constitutes a use-after-free on every received packet that goes through the timestamp path.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31501", "fixed_mainline": "7.0", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-43414", "title": "scsi: qla2xxx: Completely fix fcport double free", "description": "In qla24xx_els_dcmd_iocb() sp->free is set to qla2x00_els_dcmd_sp_free(). When an error happens, this function is called by qla2x00_sp_release(), when kref_put() releases the first and the last reference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43414", "fixed_mainline": "7.0", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64067", "title": "netfs: Fix missing barriers when accessing stream->subrequests locklessly", "description": "The list of subrequests attached to stream->subrequests is accessed without locks by netfs_collect_read_results() and netfs_collect_write_results(), and then they access subreq->flags without taking a barrier after getting the subreq pointer from the list. Relatedly, the functions that build the list don't use any sort of write barrier when constructing the list to make sure that the NETFS_SREQ_IN", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64067", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-64160", "title": "netfs: Fix potential for tearing in ->remote_i_size and ->zero_point", "description": "Fix potential tearing in using ->remote_i_size and ->zero_point by copying i_size_read() and i_size_write() and using the same seqcount as for i_size.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64160", "fixed_mainline": "7.1", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-72064", "title": "net: mana: Sync page pool RX frags for CPU", "description": "MANA allocates RX buffers from page pool fragments when frag_count is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call dma_unmap_single(). As a result, the implicit sync-for-CPU normally performed by dma_unmap_single() is missing before the packet data is passed to the networking stack.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72064", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-72477", "title": "fs/ntfs3: call _ntfs_bad_inode() when failing to rename", "description": "It is safe to call _ntfs_bad_inode on live inodes since: commit 519b078998ce (\"fs/ntfs3: Exclude call make_bad_inode for live nodes.\")", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72477", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74350", "title": "ocfs2: validate fast symlink target during inode read", "description": "ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74350", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74723", "title": "btrfs: lzo: reject inline extents without valid headers", "description": "[BUG] For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74723", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-74752", "title": "sctp: validate cookie AUTH state before use", "description": "When cookie authentication is disabled, COOKIE_ECHO restores fixed-size AUTH fields directly from peer-controlled cookie bytes. A forged RANDOM length, HMAC list, or CHUNKS list can then reach association consumers with lengths or identifiers that were never validated against the local backing arrays.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74752", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-80634", "title": "netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag", "description": "The DEV_PATH_BR_VLAN_UNTAG case post-decrements info->num_encaps inside WARN_ON_ONCE(). num_encaps is u8, so if it's already 0 the decrement still happens and wraps it to 255. The break only leaves the inner switch -- a later path entry can set info->indev back to a real device, and we end up returning with num_encaps == 255.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80634", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-80668", "title": "netfilter: nf_conntrack_expect: use conntrack GC to reap expectations", "description": "This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80668", "fixed_mainline": "7.2", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-89610", "title": "ntfs: verify run length exceeding volume boundary", "description": "The mapping pairs decoder validates that the starting LCN is within the volume but does not check if the run extends beyond the volume boundary.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89610", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-89611", "title": "ntfs: validate non-resident attribute offsets", "description": "ntfs_attr_update_meta() shifts the attribute name when converting between non-sparse and sparse attributes. Converting to sparse also adds the compressed_size field before the name and mapping pairs, requiring eight additional bytes in the attribute record.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89611", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-89654", "title": "ceph: fix UAF in check_new_map() on session freed during unlock", "description": "check_new_map() iterates mdsc->sessions[] and for each active session drops mdsc->mutex to perform per-session operations. The forced-close path (rank removed from map) correctly takes a reference on s via ceph_get_mds_session() before releasing mdsc->mutex, but three other paths do not:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89654", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-89788", "title": "ksmbd: fix tree connection use-after-free in smb2_tree_connect()", "description": "ksmbd_tree_conn_connect() publishes a new tree connection in sess->tree_conns with a single reference and returns its pointer to smb2_tree_connect(). The handler continues to initialize the object and build the response after publication. A concurrent session logoff can erase the connection and drop that reference, freeing the object while the handler still uses it.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89788", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-90104", "title": "NFSv4.1: zero referring call lists before decoding", "description": "decode_cb_sequence_args() allocates csa_rclists with kmalloc_objs(), so each referring_call_list starts uninitialized. decode_rc_list() assigns rcl_refcalls only when rcl_nrefcalls is nonzero. A valid list with zero referring calls therefore leaves the pointer uninitialized, and nfs4_callback_sequence() later passes stale slab contents to kfree().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90104", "fixed_mainline": "7.3", "cvss": 9.8, "severity": "CRITICAL" }, { "id": "CVE-2026-72329", "title": "net/liquidio: drop cached VF pci_dev LUT", "description": "The PF SR-IOV enable path caches VF pci_dev pointers in dpiring_to_vfpcidev_lut[] by iterating with pci_get_device(). Those entries do not own a reference, because the iterator drops the previous device reference on each step. The cached pointer is then dereferenced later when handling OCTEON_VF_FLR_REQUEST.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72329", "fixed_mainline": "7.2", "cvss": 9.3, "severity": "CRITICAL" }, { "id": "CVE-2026-74568", "title": "KVM: arm64: vgic: Fix race between LPI release and re-registration", "description": "Fix a potential race between decrementing an LPI's reference count and evicting that structure from the LPI xarray.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74568", "fixed_mainline": "7.2", "cvss": 9.3, "severity": "CRITICAL" }, { "id": "CVE-2026-80693", "title": "idpf: bound interrupt-vector register fill to the allocated array", "description": "idpf_get_reg_intr_vecs() fills the caller-allocated reg_vals[] array from the VIRTCHNL2_OP_ALLOC_VECTORS reply in adapter->req_vec_chunks, bounding its inner loop only by the per-chunk num_vectors. The array is sized separately: idpf_intr_reg_init() allocates kzalloc_objs(struct idpf_vec_regs, total_vecs) from caps.num_allocated_vectors and only checks the returned count after the fill. The sum of", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80693", "fixed_mainline": "7.2", "cvss": 9.3, "severity": "CRITICAL" }, { "id": "CVE-2026-89537", "title": "SUNRPC: Reject short RFC 4121 MIC tokens in gss_krb5_verify_mic_v2", "description": "gss_krb5_verify_mic_v2() reads the token ID at ptr[0..1], the flags byte at ptr[2], and padding at ptr[3..7], then passes ptr + GSS_KRB5_TOK_HDR_LEN and cksum_len to gss_krb5_mic_build_sg(). None of these accesses check read_token->len first.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89537", "fixed_mainline": "7.3", "cvss": 9.1, "severity": "CRITICAL" }, { "id": "CVE-2026-63941", "title": "KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor", "description": "ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2 (which traps) or ZCR_EL1 (which does not trap). KVM handles both in different way:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63941", "fixed_mainline": "7.1", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-64117", "title": "wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb", "description": "ieee80211_invoke_fast_rx() reads RX status through IEEE80211_SKB_RXCB(skb), which aliases the same skb->cb storage that ieee80211_rx_mesh_data() reuses as IEEE80211_TX_INFO. In the unicast forward path, mesh_data does:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64117", "fixed_mainline": "7.1", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-68470", "title": "wifi: mac80211: validate extension-frame layout before RX", "description": "Extension frames only have the extension header at the regular 802.11 header offset. The generic RX path can still reach helpers and interface dispatch code that read regular header address fields before unsupported extension subtypes are dropped.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68470", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-72380", "title": "xen/pvcalls: bound backend response req_id before indexing rsp[]", "description": "pvcalls_front_event_handler() takes req_id directly from the backend-supplied ring response and uses it to index the fixed-size bedata->rsp[] array for a memcpy() and a store, with no range check. A malicious or buggy backend can set req_id past PVCALLS_NR_RSP_PER_RING and drive an out-of-bounds write past the bedata allocation.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72380", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-72423", "title": "bpf: Guard conntrack opts error writes", "description": "The conntrack lookup and allocation kfuncs take an opts pointer together with an opts__sz argument. The verifier checks only the memory range described by opts__sz, but the wrappers unconditionally write opts->error whenever the internal lookup or allocation helper returns an error.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72423", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-72497", "title": "RDMA/bnxt_re: Add a max slot check for SQ", "description": "The variable WQE mode must be validated against the maximum slots supported by HW. The max supported value is 64K. Adding a max and min check and fail if user supplied value is more than the max supported and zero.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72497", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-72499", "title": "RDMA/bnxt_re: Free CQ toggle page after firmware teardown", "description": "Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxt_qplib_destroy_cq() won't write the toggle value to an already-freed page. Move free_page() after bnxt_qplib_destroy_cq.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72499", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74277", "title": "iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path", "description": "In iommu_dma_map_sg(), when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment `s` is incorrectly assigned from the head entry `sg->length` instead of the current entry `s->length`.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74277", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74527", "title": "octeontx2-af: Block VFs from clobbering special CGX PKIND state", "description": "PF and VF NIX LFs that share a CGX LMAC reuse the same hardware PKIND programming. When HiGig2 or EDSA parsing is enabled, a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX parse config over the PF setup.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74527", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74530", "title": "Bluetooth: hci_sync: hold conn in hci_connect_big_sync() callback", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74530", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74533", "title": "Bluetooth: ISO: fix race of kfree vs kref_get_unless_zero", "description": "hci_conn::iso_data is accessed and modified without lock or RCU. This leads to a race", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74533", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74561", "title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush", "description": "nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74561", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-74562", "title": "nexthop: take nh->lock for f6i_list walks in replace check and notify", "description": "fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74562", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80692", "title": "Bluetooth: hci_sync: hold conn in hci_connect_acl/le_sync() callbacks", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80692", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-80734", "title": "btrfs: initialize inode mapping flags for cached inodes", "description": "[BUG] When running generic/795 with 8K block size, 4K page size, the test always fails, triggering some ASSERT()s related to folio size:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80734", "fixed_mainline": "7.2", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-89513", "title": "RISC-V: KVM: Fix PMU event info array size overflow", "description": "SBI PMU EVENT_GET_INFO stores guest-controlled num_events * sizeof(*einfo) in a 32-bit integer. On RV64, num_events = 0x10000001 makes 0x100000010 truncate to 16. KVM then allocates one entry but loops over the original num_events, causing out-of-bounds reads and writes. A nested guest triggered:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89513", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-89534", "title": "svcrdma: Clear sc_cm_id when ADDR_CHANGE replacement fails", "description": "When svc_rdma_listen_handler() handles RDMA_CM_EVENT_ADDR_CHANGE, it creates a replacement listener cm_id and returns 1, telling the CM core to destroy the old one. If the replacement allocation fails, sc_cm_id still points at the old cm_id that the CM core is about to destroy. Any subsequent dereference of sc_cm_id -- such as svc_rdma_detach()'s rdma_disconnect() call -- is a use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89534", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-89601", "title": "ext2: Fix lost inode updates for IS_SYNC inodes", "description": "ext2_setsize() and ext2_xattr_set2() had a construct like:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89601", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-89907", "title": "LoongArch: KVM: Validate MSI data before routing it to EIOINTC", "description": "pch_msi_set_irq() passes e->msi.data straight into eiointc_set_irq() as the irq number. The MSI data comes from userspace, that either via a KVM_IRQ_ROUTING_MSI entry set with KVM_SET_GSI_ROUTING (used by irqfd and KVM_IRQ_LINE) or directly via KVM_SIGNAL_MSI, and is never checked against EIOINTC_IRQS.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89907", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90162", "title": "ksmbd: defer publishing granted locks to prevent UAF/double-free race", "description": "In smb2_lock(), mid-batch granted locks are published to connection-wide (conn->lock_list) and file-wide (fp->lock_list) lists immediately upon vfs_lock_file() success, while also remaining tracked on the stack-local rollback_list.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90162", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90256", "title": "Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind", "description": "hci_conn::l2cap_data is accessed without locks in l2cap_disconn_ind via hci_conn_timeout (disc_work) -> hci_proto_disconn_ind -> l2cap_disconn_ind. This is UAF if the l2cap_conn is deleted concurrently.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90256", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90380", "title": "wifi: mt76: mt792x: fix use-after-free in mt76_rx_poll_complete", "description": "A use-after-free issue occurs in mt76_rx_poll_complete due to a race condition. The STA has already been removed, but the rx_status still had a pointer to the wcid in the STA.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90380", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-90381", "title": "wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()", "description": "When performing channel switches on different radios within a short timeframe, channel contexts with different bands can be carried for each struct ieee80211_vif_chanctx_switch.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90381", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-93189", "title": "HID: core: quiesce input in hid_hw_stop() to prevent use-after-free", "description": "A driver's probe calls hid_device_io_start() to enable input delivery, then fails at a later initialization step and unwinds via hid_hw_stop(). The unwind frees struct hidraw via hidraw_disconnect() while in-flight HID reports may still be running on another CPU, dereferencing the freed object through hidraw_report_event(). syzbot reports the resulting use-after-free for the corsair-psu HID driver", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93189", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-98115", "title": "ksmbd: safely drain sessions during logoff", "description": "SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98115", "fixed_mainline": "7.3", "cvss": 8.8, "severity": "HIGH" }, { "id": "CVE-2026-64400", "title": "ksmbd: prevent path traversal bypass by restricting caseless retry", "description": "ksmbd_vfs_path_lookup() enforces LOOKUP_BENEATH to restrict path resolution within the share root. When a crafted path attempts to escape the share boundary using parent-directory components ('..'), vfs_path_parent_lookup() detects this and immediately fails, returning -EXDEV.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64400", "fixed_mainline": "7.2", "cvss": 8.6, "severity": "HIGH" }, { "id": "CVE-2026-53091", "title": "net: pull headers in qdisc_pkt_len_segs_init()", "description": "Most ndo_start_xmit() methods expects headers of gso packets to be already in skb->head.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53091", "fixed_mainline": "7.1", "cvss": 8.4, "severity": "HIGH" }, { "id": "CVE-2026-90347", "title": "arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry", "description": "Commit e057b9477232 (\"arm64: syscall: Ensure saved x0 is kept in-sync with tracer updates\") attempted to resolve a long-standing issue with syscall entry tracing, where a tracer is able to manipulate the first syscall argument without being subjected to seccomp or audit checking.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90347", "fixed_mainline": "7.3", "cvss": 8.4, "severity": "HIGH" }, { "id": "CVE-2026-89632", "title": "smb: client: fix use-before-check of ReparseDataLength in reparse_buf_ptr()", "description": "reparse_buf_ptr() reads buf->ReparseDataLength before checking that count covers the full fixed header:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89632", "fixed_mainline": "", "cvss": 8.2, "severity": "HIGH" }, { "id": "CVE-2026-31771", "title": "Bluetooth: hci_event: move wake reason storage into validated event handlers", "description": "hci_store_wake_reason() is called from hci_event_packet() immediately after stripping the HCI event header but before hci_event_func() enforces the per-event minimum payload length from hci_ev_table. This means a short HCI event frame can reach bacpy() before any bounds check runs.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31771", "fixed_mainline": "7.0", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-89709", "title": "lockd, nfsd: RCU-protect nlmsvc_ops dispatch", "description": "nlmsvc_ops is published by nfsd_lockd_init() and cleared by nfsd_lockd_shutdown() with plain stores, while lockd dereferences it unguarded from dispatch sites in fs/lockd/svcsubs.c. The pointer targets nfsd's .rodata and the fopen/fclose callbacks live in nfsd's .text, so a stale load after rmmod nfsd results in either a NULL deref or a module-text use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89709", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-90301", "title": "ocfs2: o2hb: quiesce negotiate handlers and timeout work", "description": "Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90301", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-93221", "title": "nfsd: convert nfsd_net boolean flags to unsigned long flags word", "description": "nfsd_net contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4_end_grace() guards its drain path with a plain bool:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93221", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-93282", "title": "ksmbd: fix maximum allowed access checks", "description": "The DACL permission check looks for an ACE matching the current user and falls back to the Everyone ACE. It does not consider an Authenticated Users ACE, even though an authenticated session is a member of that well-known group.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93282", "fixed_mainline": "7.3", "cvss": 8.1, "severity": "HIGH" }, { "id": "CVE-2026-80747", "title": "drm/amdkfd: Add bounds check for CRAT subtype length", "description": "The CRAT parser validates that the subtype header fits within the image, but does not verify that the advertised subtype length fits. A malformed CRAT table with an oversized length field causes out-of-bounds reads when kfd_parse_subtype() casts the header to specific subtype structures.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80747", "fixed_mainline": "7.2", "cvss": 8.0, "severity": "HIGH" }, { "id": "CVE-2025-71074", "title": "functionfs: fix the open/removal races", "description": "ffs_epfile_open() can race with removal, ending up with file->private_data pointing to freed object.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71074", "fixed_mainline": "6.19", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-45991", "title": "udf: fix partition descriptor append bookkeeping", "description": "Mounting a crafted UDF image with repeated partition descriptors can trigger a heap out-of-bounds write in part_descs_loc[].", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45991", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-46210", "title": "media: iris: fix use-after-free of fmt_src during MBPF check", "description": "During concurrency testing, multiple instances can run in parallel, and each instance uses its own inst->lock while the core->lock protects the list of active instances. The race happens because these locks cover different scopes, inst->lock protects only the internals of a single instance, while the Macro Blocks Per Frame (MBPF) checker walks the core list under core->lock and reads fields like f", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46210", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-46311", "title": "drm/amdgpu/userq: fix access to stale wptr mapping", "description": "Use drm_exec to take both locks i.e vm root bo and wptr_obj bo to access the mapping data properly.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46311", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-46330", "title": "Revert \"net/smc: Introduce TCP ULP support\"", "description": "This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46330", "fixed_mainline": "7.0", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-53009", "title": "ice: fix double-free of tx_buf skb", "description": "If ice_tso() or ice_tx_csum() fail, the error path in ice_xmit_frame_ring() frees the skb, but the 'first' tx_buf still points to it and is marked as valid (ICE_TX_BUF_SKB). 'next_to_use' remains unchanged, so the potential problem will likely fix itself when the next packet is transmitted and the tx_buf gets overwritten. But if there is no next packet and the interface is brought down instead, ic", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53009", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-53024", "title": "greybus: raw: fix use-after-free if write is called after disconnect", "description": "If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y):", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53024", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-53025", "title": "greybus: raw: fix use-after-free on cdev close", "description": "This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_FREE_DEFAULT_ON=y):", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53025", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-53401", "title": "fbdev: omap2: fix use-after-free in omapfb_mmap", "description": "omapfb_mmap() has a race condition with OMAPFB_SETUP_PLANE ioctl that can lead to use-after-free:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53401", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63858", "title": "netfilter: nf_tables: add hook transactions for device deletions", "description": "Restore the flag that indicates that the hook is going away, ie. NFT_HOOK_REMOVE, but add a new transaction object to track deletion of hooks without altering the basechain/flowtable hook_list during the preparation phase.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63858", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63879", "title": "drm/amdgpu: fix amdgpu_hmm_range_get_pages", "description": "The notifier sequence must only be read once or otherwise we could work with invalid pages.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63879", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-63977", "title": "dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work", "description": "The change_work was introduced to send device change notifications from DPLL device callbacks without deadlocking on dpll_lock, since the callbacks are already invoked under that lock. Now that __dpll_device_change_ntf() is exported for callers that already hold dpll_lock, use it directly and remove the change_work infrastructure entirely.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63977", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-64057", "title": "afs: Fix the locking used by afs_get_link()", "description": "The afs filesystem in the kernel doesn't do locking correctly for symbolic links. There are a number of problems:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64057", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-64123", "title": "net: hsr: defer node table free until after RCU readers", "description": "HSR node-list and node-status generic-netlink operations run under rcu_read_lock(). They walk hsr->node_db through hsr_get_next_node() and hsr_get_node_data(), but RTM_DELLINK teardown removes the same node table with plain list_del() and frees each node immediately.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64123", "fixed_mainline": "7.1", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-64388", "title": "smb/client: fix chown/chgrp with SMB3 POSIX Extensions", "description": "Ownership (chown) and group (chgrp) modifications were being ignored when mounting with SMB3 POSIX Extensions unless CIFS_MOUNT_CIFS_ACL or CIFS_MOUNT_MODE_FROM_SID were also explicitly set.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64388", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68295", "title": "LoongArch: BPF: Zero-extend signed ALU32 div/mod results", "description": "ALU32 operations write a 32-bit result and leave the upper 32 bits of the BPF register zero. The LoongArch JIT sign-extends the result of signed ALU32 BPF_DIV and BPF_MOD (off=1), so a negative 32-bit quotient or remainder leaves bits 63:32 set in JITted code while the verifier and interpreter model those bits as zero.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68295", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68305", "title": "drm/xe/vf: Add drm_dev guards when detaching CCS read/write buffers", "description": "CCS read/write buffers are freed during BO destruction. In some cases, BOs may be destroyed after the device is unbound but while the DRM structure remains valid, leading to NULL pointer dereferences when accessing device resources.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68305", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68323", "title": "tipc: serialize udp bearer replicast list updates", "description": "tipc_udp_rcast_add() and cleanup_bearer() both update ub->rcast.list with list_add_rcu() / list_del_rcu(), but nothing serializes them. The add runs from the encap receive softirq (via tipc_udp_rcast_disc()) without rtnl_lock(), so it can race the cleanup delete and corrupt the list:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68323", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68382", "title": "drm/xe/guc: Hold device ref until queue teardown completes", "description": "GuC exec queue destruction can run asynchronously. If the final device put happens from a destroy worker, drmm cleanup can end up draining the same workqueue and deadlock.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68382", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68383", "title": "drm/xe/guc: Keep scheduler timeline name alive", "description": "The scheduler keeps a pointer to the timeline name, but q->name is freed with the exec queue while scheduler fences can still reference it.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68383", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68399", "title": "bpf: Fix UAF in sock clone early bailouts", "description": "Similar to recent commit 9b51a6155d14 (\"bpf,fork: wipe ->bpf_storage before bailouts that access it\"), sk_clone() performs an initial shallow copy of the socket field ->sk_bpf_storage via sock_copy() for the cloned socket newsk.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68399", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-68404", "title": "wifi: cfg80211: use wiphy work for socket owner autodisconnect", "description": "nl80211_netlink_notify() walks the cfg80211 wireless device list when a NETLINK_GENERIC socket is released. If the socket owns a connection, the notifier queues the embedded wdev->disconnect_wk work item.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68404", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-72331", "title": "accel/amdxdna: Fix VMA access race", "description": "aie2_populate_range() and amdxdna_umap_release() access a saved VMA pointer that may have already been freed, leading to a potential use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72331", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-72345", "title": "net/mlx5: LAG, Fix off-by-one in single-FDB error rollback", "description": "On failure at index i, the reverse cleanup loop in mlx5_lag_create_single_fdb() starts from i, so the failed index itself is rolled back. That can operate on uninitialized state or double-tear-down a rule the add_one path already self-rolled-back.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72345", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-72404", "title": "tipc: fix UAF in cleanup_bearer() due to premature dst_cache_destroy()", "description": "TIPC UDP media bearer teardown calls dst_cache_destroy() on its replicast caches before calling synchronize_net() to wait for concurrent RCU readers (transmitters) to finish:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72404", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-72454", "title": "i3c: mipi-i3c-hci: Fix race in i3c_hci_addr_to_dev()", "description": "i3c_hci_addr_to_dev() walks bus->devs.i3c, which is protected by bus.lock (rwsem). However, it is invoked from the MIPI I3C HCI IRQ handler, which cannot take bus.lock. This allows concurrent device addition/removal in the I3C core to modify the list while it is being traversed, potentially leading to use-after-free or crashes.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72454", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74260", "title": "netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them", "description": "Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74260", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74314", "title": "bpf: Cancel special fields on map value recycle", "description": "Map update and delete paths currently call bpf_obj_free_fields() when a value is being replaced or recycled. That makes field destruction depend on the context of the update/delete operation. For tracing programs this can include NMI context, where referenced kptr destructors, uptr unpinning, and graph root destruction are not generally safe.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74314", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74317", "title": "ixgbe: do not configure xps for XDP queues", "description": "netif_set_xps_queue() should not be called for an XDP Tx queue, since such queues are not netdev-exposed. On systems with number of CPUs >=64, on E610 adapter, netdev is configured with maximum number queue pairs being 63 (due to MSI-X assignment), but configuring XDP results in 64 XDP queues.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74317", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74338", "title": "bpf: Reject sleepable BPF_LSM_CGROUP programs at load time", "description": "The cgroup shim runs under rcu_read_lock_dont_migrate(), so we should not attach any sleepable BPF programs there. Add support to the verifier to explicitly reject attempts to load sleepable BPF programs destined for LSM cgroup attachment.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74338", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74354", "title": "bpf: Take mmap_lock in zap_pages()", "description": "zap_vma_range() requires the owning mm's mmap_lock to be held.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74354", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74367", "title": "wifi: ath12k: fix inconsistent arvif state in vdev_create error paths", "description": "ath12k_mac_vdev_create() has three error path issues that leave arvif in an inconsistent state:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74367", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74449", "title": "drm/amd/display: Fix divide-by-zero in calculate_mcache_setting on zero viewport", "description": "If a plane reaches calculate_mcache_setting with a zero-area viewport, calculate_mcache_setting exits early with num_mcaches == 0 and mvmpg_width/height == 0. This will cause a divide-by-zero panic and can also cause an underflow on num_mcaches.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74449", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74529", "title": "Bluetooth: hci_sync: hold conn in hci_connect_pa_sync() callback", "description": "There is theoretical UAF if the conn is freed while the hci_sync task is running.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74529", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74544", "title": "net/sched: cls_u32: validate offshift to prevent shift-out-of-bounds", "description": "u32_change() copies the user-provided tc_u32_sel.offshift (unsigned char, 0-255) into the kernel knode object without bounds validation. When a packet later hits u32_classify() with TC_U32_VAROFFSET set, it evaluates `ntohs(offmask & *data) >> offshift` where the left operand is a 16-bit value promoted to a 32-bit int. Any offshift >= 32 is undefined behavior per C11 6.5.7p3, triggerable by an unp", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74544", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74605", "title": "eventfs: Use children field for rcu head and add memory barriers", "description": "When an eventfs inode is freed, it sets ei->is_freed and then uses its ei->list to add it to the srcu link list as the list field is a union with the rcu list head. As the ei->list is used to iterate over an SRCU protected list without taking the eventfs_mutex, there's nothing stopping the iteration over that list to see the ei->rcu instead of the ei->list and it will read a corrupt target.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74605", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74715", "title": "bpf: Fix netns reference imbalance in conntrack kfuncs", "description": "The opts argument of the BPF conntrack kfuncs can point to a shared map value. __bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry() read opts->netns_id separately when acquiring and releasing the network namespace reference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74715", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74721", "title": "accel/amxdna: Fix page-insertion errors in amdxdna_insert_pages()", "description": "Two error paths in amdxdna_insert_pages() called vma->vm_ops->close(vma) before returning an error code to the caller. This is incorrect: amdxdna_gem_obj_mmap() registers an HMM interval notifier before calling amdxdna_insert_pages(), and on a hard error it jumps to hmm_unreg to undo that registration. Calling vm_ops->close() manually \u2014 which drops the shmem pages_pin_count and the GEM object refe", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74721", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74733", "title": "gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock", "description": "Locking is disabled in the regmap config as this driver uses its own lock. This means that all calls to regmap functions (read or write) must hold the i2c_lock. The function pca953x_irq_bus_sync_unlock() did not do this, and it was therefore possible that multiple threads could cause an incorrect register to be read/written.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74733", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-74747", "title": "ipvs: revalidate ihl to prevent out-of-bounds access", "description": "While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent out-of-bounds access.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74747", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80579", "title": "fbdev: clear fb_info->mode before deleting a videomode", "description": "fb_set_var() can delete a mode from info->modelist when userspace passes FB_ACTIVATE_INV_MODE through FBIOPUT_VSCREENINFO. The code checks that the mode being deleted is not the current info->var and that fbcon is not using it, but it does not check fb_info->mode.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80579", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-80580", "title": "fbdev: bound mode sysfs output to the sysfs buffer", "description": "mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80580", "fixed_mainline": "7.2", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89584", "title": "block: validate user space vectors during extraction", "description": "The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dma_alignment as the bio is built from the iov_iter, rejecting misaligned early with -EINVAL.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89584", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89755", "title": "mm/migrate_device: clear stale mapping after freeing swapcache", "description": "__migrate_device_pages() reads the folio mapping before calling folio_free_swap(). When folio_free_swap() succeeds, the folio is removed from the swap cache, but the saved mapping still points to swap_space.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89755", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89764", "title": "rust: devres: fix race between concurrent revokers", "description": "There is a potential race condition when two paths try to revoke a Devres concurrently.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89764", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89793", "title": "ublk: clear VM_MAYWRITE on read-only ublk char device mmap", "description": "ublk_ch_mmap() rejects mmap requests with VM_WRITE set, but never clears VM_MAYWRITE on the resulting read-only mapping. This allows a userspace daemon to mmap the per-queue command buffer PROT_READ, then upgrade it to PROT_WRITE via mprotect(), since VM_MAYWRITE was never cleared.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89793", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-89805", "title": "drm/pagemap: Fix folio allocation fallback and use-after-put", "description": "drm_pagemap_migrate_populate_ram_pfn() had two issues when populating RAM PFNs with higher-order folios:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89805", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90093", "title": "Bluetooth: L2CAP: access chan->conn safely in get/setsockopt", "description": "Since commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\") l2cap_chan::conn has held reference and remains non-NULL also after the corresponding hci_conn is deleted. In this state accessing various fields eg. hci_conn::hdev is invalid, which leads to KASAN crash in l2cap_sock_setsockopt() access of conn->hcon->hdev.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90093", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90111", "title": "ip6mr: do not clone dst in ip6mr_cache_report()", "description": "IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mr_cache_unresolved() places the skb onto the unresolved queue, escaping the receive-side RCU grace period.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90111", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90142", "title": "virtio_net: Fix resize of the RX ring", "description": "When a AF_XDP socket is attached, the virtnet_rx_resize should resize the rq->xsk_buffs XSK buffer array. Otherwise, when the size grows, the virtnet_rx_resume() causes a write past the end of the array. This is easily reproducable with", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90142", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90177", "title": "bpf: Check pointer type for all atomic RMW paths", "description": "Atomic RMW verification records an instruction pointer type only when the current destination is PTR_TO_ARENA. A second path can therefore reach the same instruction with an ordinary pointer without comparing it against the saved arena type.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90177", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90217", "title": "bpf: Compare iterator types during state pruning", "description": "An iterator stack slot can be MEM_RCU or PTR_UNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90217", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90237", "title": "netfilter: nft_ct: move custom expectation support to helper", "description": "Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for confirmed conntrack\") which restricted it to unconfirmed conntracks.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90237", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90289", "title": "drm/amd/display: Resize MST HDCP per-connector arrays to 32", "description": "AMDGPU_DM_MAX_DISPLAY_INDEX is 31. It suggest a maximum number of 32 connectors. But the way it's used is like MAX_DISPLAY_COUNT. Hence we're off by one with DRM core, which supports a max of 32 connectors.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90289", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90317", "title": "bpf: Invalidate RCU pointers after final spin unlock", "description": "In a sleepable BPF program, a spin lock can provide the only RCU protection for a kptr. The final bpf_spin_unlock() ends that protection, but the verifier leaves the pointer valid. Another CPU can then free the object before the pointer is used. A capability-limited runtime PoC triggered a task_struct use-after-free in __bpf_get_task_stack().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90317", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90320", "title": "ocfs2: validate external xattr entries when reading metadata", "description": "ocfs2_validate_xattr_block() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90320", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90321", "title": "ocfs2: validate inline xattrs during inode block validation", "description": "Patch series \"ocfs2: validate xattr entry bounds\", v7.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90321", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-92485", "title": "bpf: Fix WARNING in bpf_tracing_link_release", "description": "The trampoline could be corrupted by the blindly 'tr->flags = BPF_TRAMP_F_TAIL_CALL_CTX' in verifier.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92485", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93105", "title": "esp: do not unref managed frag pages in esp_ssg_unref()", "description": "esp_ssg_unref() releases the page references held on the source scatterlist after the AEAD operation completes. It calls skb_page_unref() on every frag page for an out-of-place transform (req->src != req->dst), and in the error path of esp_output_tail() (already_unref == true) on the request's own scatterlist.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93105", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93122", "title": "usb: gadget: uac: validate rate list length before storing", "description": "UAC1 and UAC2 configfs rate-list attributes parse a comma-separated list of sampling rates and store each parsed value in fixed-size arrays. The arrays have UAC_MAX_RATES entries, but the store paths do not check that the input contains at most that many tokens before writing through opts->name##s[i++].", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93122", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93125", "title": "bpf: Reject rdonly/rdwr_buf_size kfunc arguments that exceed u32 max", "description": "check_kfunc_args() detects a kfunc argument named rdonly_buf_size or rdwr_buf_size and stores reg->var_off.value into meta->r0_size, a u64, and does not bound it. check_kfunc_call() later copies that value into the returned register's mem_size field:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93125", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93144", "title": "bpf: Reject writes through untrusted BTF pointers", "description": "check_ptr_to_btf_access() lets program-type btf_struct_access callbacks validate writes before the default BTF access path rejects non-read accesses. That bypasses the read-only policy for untrusted BTF pointers created by helpers such as bpf_rdonly_cast().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93144", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93148", "title": "bpf: Reject MEM_ALLOC BTF accesses past object bounds", "description": "BTF struct walks relax the struct-size check for accesses through a trailing flexible array. That is valid for ordinary BTF type walking, but PTR_TO_BTF_ID | MEM_ALLOC values point to objects allocated with the static BTF type size.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93148", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93175", "title": "drm/amd/display: Fix dangling pointer in CRTC reset function", "description": "amdgpu_dm_crtc_reset_state() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93175", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-93201", "title": "dm-pcache: validate seg_id fields from persistent memory", "description": "cache_pos_decode(), cache_key_decode() and the last-kset branches of cache_replay(), the writeback worker and the GC worker take a cache segment id from the cache device metadata and index cache->segments[] with it without checking it against cache->n_segs. That metadata is only CRC-protected with a fixed public seed, so whoever supplies the cache device on a table load (CAP_SYS_ADMIN) controls th", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93201", "fixed_mainline": "7.3", "cvss": 7.8, "severity": "HIGH" }, { "id": "CVE-2026-90408", "title": "wifi: ath12k: fix overreads in ath12k_wmi_process_csa_switch_count_event()", "description": "There is no policy entry for WMI_TAG_PDEV_CSA_SWITCH_COUNT_STATUS_EVENT, so the parse infrastructure does not enforce a minimum length for the event struct. Additionally, the num_vdevs field is taken directly from firmware and used as a loop bound over the vdev_ids array without checking that it fits within the TLV payload. Either condition can cause an out-of-bounds read.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90408", "fixed_mainline": "7.3", "cvss": 7.7, "severity": "HIGH" }, { "id": "CVE-2026-52956", "title": "libceph: Fix potential out-of-bounds access in __ceph_x_decrypt()", "description": "In __ceph_x_decrypt(), a part of the buffer p is interpreted as a ceph_x_encrypt_header, and the magic field of this struct is accessed. This happens without any guarantee that the buffer is large enough to hold this struct. The function parameter ciphertext_len represents the length of the ciphertext to decrypt and is guaranteed to be at most the remaining size of the allocated buffer p. However,", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52956", "fixed_mainline": "7.1", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-52960", "title": "ceph: put folios not suitable for writeback", "description": "The batch holds references to the folios (see `filemap_get_folios`, `folio_batch_release`), so we need to `folio_put` the folios we remove.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52960", "fixed_mainline": "7.1", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-64020", "title": "nvme-pci: fix dma_vecs leak on p2p memory", "description": "We don't unmap P2P memory, so we don't need to track it. The dma_vec allocation was getting leaked on the completion.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64020", "fixed_mainline": "7.1", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-74374", "title": "md/raid1,raid10: fix error-path detection with md_cloned_bio()", "description": "Detect the error path using md_cloned_bio() instead of relying on r1_bio in raid1 or r10_bio->read_slot in raid10, which may be NULL or -1 after splitting and resubmitting a failed bio.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74374", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-74745", "title": "eth: bnxt: avoid deadlock when canceling IRQ affinity notifier", "description": "Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier (to restart the queue) and cancels the work under the same lock. This may obviously deadlock.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74745", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-74750", "title": "ovpn: defer key slot crypto freeing to workqueue", "description": "Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: crypto_free_aead can sleep, for example when an async or hardware implementation has teardown work to complete.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74750", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-80631", "title": "btrfs: lzo: reject compressed segment that overflows the compressed input", "description": "lzo_decompress_bio() validates each on-disk segment length seg_len only against the workspace cbuf size, not against the compressed input size (compressed_len, the total folio bytes of the bio). A crafted extent can carry a segment whose seg_len passes the cbuf check but runs past the end of the bio, so copy_compressed_segment() walks off the last folio: get_current_folio() then returns the NULL f", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80631", "fixed_mainline": "7.2", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-90234", "title": "NFS: Return a delegation the client fails to record", "description": "When an NFS server grants a delegation in an OPEN reply, nfs_inode_set_delegation() records it on the client. However, three of its error flows return without sending DELEGRETURN.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90234", "fixed_mainline": "7.3", "cvss": 7.5, "severity": "HIGH" }, { "id": "CVE-2026-90427", "title": "iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_krealloc()", "description": "__tegra241_cmdqv_probe() uses devm_krealloc() to grow @smmu into the larger tegra241_cmdqv, which frees the original @smmu once it relocates. A failure after that returned NULL, and the caller then dereferenced the freed @smmu on its fallback path.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90427", "fixed_mainline": "7.3", "cvss": 7.4, "severity": "HIGH" }, { "id": "CVE-2026-93260", "title": "powerpc/xive: propagate IPI init errors to prevent use-after-free", "description": "When xive_init_ipis() fails (e.g. irq_domain_alloc_irqs() fails), the error path frees the global xive_ipis array. However, xive_smp_probe() previously ignored this failure and proceeded to call xive_setup_cpu_ipi(), which dereferences the already-freed xive_ipis pointer -- a use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93260", "fixed_mainline": "7.3", "cvss": 7.4, "severity": "HIGH" }, { "id": "CVE-2026-74419", "title": "accel/amdxdna: Adjust size for copy_to_user()", "description": "The amount of data returned to user space should be limited by the buffer size provided by the application. If the buffer is smaller than the data size, return only the portion that fits instead of failing.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74419", "fixed_mainline": "7.2", "cvss": 7.3, "severity": "HIGH" }, { "id": "CVE-2026-80738", "title": "bpf: Check sk_state before sk_protocol in bpf_tcp_*_syncookie", "description": "bpf_tcp_gen_syncookie and bpf_tcp_check_syncookie accept a socket pointer 'sk' with argument type ARG_PTR_TO_BTF_ID_SOCK_COMMON. However, they access sk->sk_protocol without validating whether 'sk' represents a full socket.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80738", "fixed_mainline": "7.2", "cvss": 7.3, "severity": "HIGH" }, { "id": "CVE-2026-43042", "title": "mpls: add seqcount to protect the platform_label{,s} pair", "description": "The RCU-protected codepaths (mpls_forward, mpls_dump_routes) can have an inconsistent view of platform_labels vs platform_label in case of a concurrent resize (resize_platform_label_table, under platform_mutex). This can lead to OOB accesses.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43042", "fixed_mainline": "7.0", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-52988", "title": "netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase", "description": "Publish new hooks in the list into the basechain/flowtable using splice_list_rcu() to ensure netlink dump list traversal via rcu is safe while concurrent ruleset update is going on.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52988", "fixed_mainline": "7.1", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-68103", "title": "drm/amdgpu: reject mapping a reserved doorbell to a new queue", "description": "When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68103", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-68447", "title": "drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size", "description": "CRIU checkpoint copies the MQD control stack using cp_hqd_cntl_stack_size from hardware without bounding it to the allocated BO region. If the HW field is larger than the queue's control stack allocation, memcpy reads past the BO into adjacent GTT memory and can leak kernel data to userspace.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68447", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-72397", "title": "hwmon: (pmbus/core) honor vrm_version in pmbus_data2reg_vid()", "description": "pmbus_data2reg_vid() hardcoded the VR11 encoding regardless of the vrm_version configured by the driver, while pmbus_reg2data_vid() already switched on it. Any driver that selects a non-VR11 VID mode and exposes a regulator (or hwmon vout setter) sent dangerously wrong codes to PMBUS_VOUT_COMMAND -- e.g. an nvidia195mv part asked for 200 mV got the VR11 clamp to 500 mV encoded as 0xB2, which the c", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72397", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-72440", "title": "md/raid1: fix writes_pending and barrier reference leaks on write failures", "description": "raid1_make_request() acquires a writes_pending reference with md_write_start() before calling raid1_write_request(). Several failure paths in raid1_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72440", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-74713", "title": "vhost_iotlb: bound map allocation in add_range", "description": "vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries after reaching their configured limit.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74713", "fixed_mainline": "7.2", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-89705", "title": "nfsd: restore rq_status_counter to even on all nfsd_dispatch() exit paths", "description": "nfsd_dispatch() sets rq_status_counter to an odd value once a request has been decoded, and back to an even value once it has been fully processed, forming a seq-lock like protocol with the lockless reader in nfsd_nl_rpc_status_get_dumpit().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89705", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-90174", "title": "ksmbd: fix slab-out-of-bounds read in ksmbd_alloc_user()", "description": "ksmbd_alloc_user() copies resp->hash_sz bytes out of the mountd IPC login response with", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90174", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-90401", "title": "md: remove REQ_NOWAIT support from raid1/10/456", "description": "REQ_NOWAIT support in md personalities that can block internally is fundamentally incomplete. While reads can avoid some blocking paths, write requests can still encounter cases where one mirror succeeds while another returns -EAGAIN. At that point md cannot distinguish queue pressure from a real device failure, so it can neither record a bad block nor safely retry the write without REQ_NOWAIT, le", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90401", "fixed_mainline": "7.3", "cvss": 7.1, "severity": "HIGH" }, { "id": "CVE-2026-93116", "title": "platform/x86: asus-wmi: fix resource leaks on probe failure", "description": "During driver initialization in asus_wmi_add(), various subsystems are registered sequentially. However, the error path labels are out of order relative to the registration sequence.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93116", "fixed_mainline": "7.3", "cvss": 7.0, "severity": "HIGH" }, { "id": "CVE-2026-93176", "title": "drm/amd/display: Fix dangling pointer in plane reset function", "description": "amdgpu_dm_plane_drm_plane_reset() frees the old state before allocating a new one. If kzalloc() fails, the function returns without updating the state pointer, leaving a dangling pointer to already freed memory.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93176", "fixed_mainline": "7.3", "cvss": 7.0, "severity": "HIGH" }, { "id": "CVE-2021-47645", "title": "media: staging: media: zoran: calculate the right buffer number for zoran_reap_stat_com", "description": "On the case tmp_dcim=1, the index of buffer is miscalculated. This generate a NULL pointer dereference later.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2021-47645", "fixed_mainline": "", "cvss": 5.5, "severity": "MEDIUM" }, { "id": "CVE-2025-71306", "title": "ima: Fix stack-out-of-bounds in is_bprm_creds_for_exec()", "description": "KASAN reported a stack-out-of-bounds access in ima_appraise_measurement from is_bprm_creds_for_exec:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71306", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2025-71308", "title": "accel/amdxdna: Fix potential NULL pointer dereference in context cleanup", "description": "aie_destroy_context() is invoked during error handling in aie2_create_context(). However, aie_destroy_context() assumes that the context's mailbox channel pointer is non-NULL. If mailbox channel creation fails, the pointer remains NULL and calling aie_destroy_context() can lead to a NULL pointer dereference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71308", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2025-71313", "title": "PCI: endpoint: Add missing NULL check for alloc_workqueue()", "description": "alloc_workqueue() can return NULL on memory allocation failure. Without proper error checking, this may lead to a NULL pointer dereference when queue_work() is later called with the NULL workqueue pointer in epf_ntb_epc_init().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2025-71313", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-100072", "title": "ACPI: platform: Use acpi_bus_get_primary_device()", "description": "The acpi_get_first_physical_node() usage in acpi_platform_fill_resource() and acpi_create_platform_device() is generally unsafe because in theory the device returned by it may be freed at any time [1].", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100072", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-100073", "title": "ext4: fix transaction overflow during writeback", "description": "Commit 95ad8ee45cdb (\"ext4: correct the reserved credits for extent conversion\") was correct to note that we need to reserve enough credits for all extents possibly underlying a large folio. However it was too eager to reduce the number of reserved credits. Extent conversion may not only need to touch several leaf extent blocks, it may also need to split extents - for example a single large unwrit", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100073", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-23328", "title": "accel/amdxdna: Fix NULL pointer dereference of mgmt_chann", "description": "mgmt_chann may be set to NULL if the firmware returns an unexpected error in aie2_send_mgmt_msg_wait(). This can later lead to a NULL pointer dereference in aie2_hw_stop().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23328", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-23374", "title": "blktrace: fix __this_cpu_read/write in preemptible context", "description": "tracing_record_cmdline() internally uses __this_cpu_read() and __this_cpu_write() on the per-CPU variable trace_cmdline_save, and trace_save_cmdline() explicitly asserts preemption is disabled via lockdep_assert_preemption_disabled(). These operations are only safe when preemption is off, as they were designed to be called from the scheduler context (probe_wakeup_sched_switch() / probe_wakeup()).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23374", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-23377", "title": "ice: change XDP RxQ frag_size from DMA write length to xdp.frame_sz", "description": "The only user of frag_size field in XDP RxQ info is bpf_xdp_frags_increase_tail(). It clearly expects whole buff size instead of DMA write size. Different assumptions in ice driver configuration lead to negative tailroom.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23377", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-31710", "title": "smb: client: fix dir separator in SMB1 UNIX mounts", "description": "When calling cifs_mount_get_tcon() with SMB1 UNIX mounts, @cifs_sb->mnt_cifs_flags needs to be read or updated only after calling reset_cifs_unix_caps(), otherwise it might end up with missing CIFS_MOUNT_POSIXACL and CIFS_MOUNT_POSIX_PATHS bits.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31710", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-31777", "title": "ALSA: ctxfi: Check the error for index mapping", "description": "The ctxfi driver blindly assumed a proper value returned from daio_device_index(), but it's not always true. Add a proper error check to deal with the error from the function.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-31777", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43022", "title": "Bluetooth: hci_sync: hci_cmd_sync_queue_once() return -EEXIST if exists", "description": "hci_cmd_sync_queue_once() needs to indicate whether a queue item was added, so caller can know if callbacks are called, so it can avoid leaking resources.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43022", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43045", "title": "mshv: Fix error handling in mshv_region_pin", "description": "The current error handling has two issues:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43045", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43053", "title": "xfs: close crash window in attr dabtree inactivation", "description": "When inactivating an inode with node-format extended attributes, xfs_attr3_node_inactive() invalidates all child leaf/node blocks via xfs_trans_binval(), but intentionally does not remove the corresponding entries from their parent node blocks. The implicit assumption is that xfs_attr_inactive() will truncate the entire attr fork to zero extents afterwards, so log recovery will never reach the roo", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43053", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43095", "title": "ASoC: SDCA: Fix errors in IRQ cleanup", "description": "IRQs are enabled through sdca_irq_populate() from component probe using devm_request_threaded_irq(), this however means the IRQs can persist if the sound card is torn down. Some of the IRQ handlers store references to the card and the kcontrols which can then fail. Some detail of the crash was explained in [1].", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43095", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43115", "title": "srcu: Use irq_work to start GP in tiny SRCU", "description": "Tiny SRCU's srcu_gp_start_if_needed() directly calls schedule_work(), which acquires the workqueue pool->lock.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43115", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43174", "title": "io_uring/zcrx: fix post open error handling", "description": "Closing a queue doesn't guarantee that all associated page pools are terminated right away, let the refcounting do the work instead of releasing the zcrx ctx directly.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43174", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43191", "title": "drm/amd/display: Adjust PHY FSM transition to TX_EN-to-PLL_ON for TMDS on DCN35", "description": "[Why] A backport of the change made for DCN401 that addresses an issue where we turn off the PHY PLL when disabling TMDS output, which causes the OTG to remain stuck.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43191", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43204", "title": "ASoC: qcom: q6asm: drop DSP responses for closed data streams", "description": "'Commit a354f030dbce (\"ASoC: qcom: q6asm: handle the responses after closing\")' attempted to ignore DSP responses arriving after a stream had been closed.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43204", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43228", "title": "hfs: Replace BUG_ON with error handling for CNID count checks", "description": "In a06ec283e125 next_id, folder_count, and file_count in the super block info were expanded to 64 bits, and BUG_ONs were added to detect overflow. This triggered an error reported by syzbot: if the MDB is corrupted, the BUG_ON is triggered. This patch replaces this mechanism with proper error handling and resolves the syzbot reported bug.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43228", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43299", "title": "btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure()", "description": "[BUG] There is a bug report that when btrfs hits ENOSPC error in a critical path, btrfs flips RO (this part is expected, although the ENOSPC bug still needs to be addressed).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43299", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43308", "title": "btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref()", "description": "There is no need to BUG(), we can just return an error and log an error message.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43308", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43310", "title": "media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC", "description": "For the i.MX8MQ platform, there is a hardware limitation: the g1 VPU and g2 VPU cannot decode simultaneously; otherwise, it will cause below bus error and produce corrupted pictures, even potentially lead to system hang.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43310", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43311", "title": "soc/tegra: pmc: Fix unsafe generic_handle_irq() call", "description": "Currently, when resuming from system suspend on Tegra platforms, the following warning is observed:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43311", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43326", "title": "sched_ext: Fix SCX_KICK_WAIT deadlock by deferring wait to balance callback", "description": "SCX_KICK_WAIT busy-waits in kick_cpus_irq_workfn() using smp_cond_load_acquire() until the target CPU's kick_sync advances. Because the irq_work runs in hardirq context, the waiting CPU cannot reschedule and its own kick_sync never advances. If multiple CPUs form a wait cycle, all CPUs deadlock.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43326", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-43443", "title": "ASoC: amd: acp-mach-common: Add missing error check for clock acquisition", "description": "The acp_card_rt5682_init() and acp_card_rt5682s_init() functions did not check the return values of clk_get(). This could lead to a kernel crash when the invalid pointers are later dereferenced by clock core functions.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-43443", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-45961", "title": "gfs2: fix memory leaks in gfs2_fill_super error path", "description": "Fix two memory leaks in the gfs2_fill_super() error handling path when transitioning a filesystem to read-write mode fails.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-45961", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-46008", "title": "mm/damon/core: fix damos_walk() vs kdamond_fn() exit race", "description": "When kdamond_fn() main loop is finished, the function cancels remaining damos_walk() request and unset the damon_ctx->kdamond so that API callers and API functions themselves can show the context is terminated. damos_walk() adds the caller's request to the queue first. After that, it shows if the kdamond of the damon_ctx is still running (damon_ctx->kdamond is set). Only if the kdamond is running,", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46008", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46017", "title": "mm: fix deferred split queue races during migration", "description": "migrate_folio_move() records the deferred split queue state from src and replays it on dst. Replaying it after remove_migration_ptes(src, dst, 0) makes dst visible before it is requeued, so a concurrent rmap-removal path can mark dst partially mapped and trip the WARN in deferred_split_folio().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46032", "title": "KVM: nSVM: Triple fault if restore host CR3 fails on nested #VMEXIT", "description": "If loading L1's CR3 fails on a nested #VMEXIT, nested_svm_vmexit() returns an error code that is ignored by most callers, and continues to run L1 with corrupted state. A sane recovery is not possible in this case, and HW behavior is to cause a shutdown. Inject a triple fault instead, and do not return early from nested_svm_vmexit(). Continue cleaning up the vCPU state (e.g. clear pending exception", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46032", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46147", "title": "KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()", "description": "Two bugs exist in the vCPU initialisation path:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46147", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46153", "title": "8021q: delete cleared egress QoS mappings", "description": "vlan_dev_set_egress_priority() currently keeps cleared egress priority mappings in the hash as tombstones. Repeated set/clear cycles with distinct skb priorities therefore accumulate mapping nodes until device teardown and leak memory.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46153", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46245", "title": "drm/amd/display: Fix dc_link NULL handling in HPD init", "description": "amdgpu_dm_hpd_init() may see connectors without a valid dc_link.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46245", "fixed_mainline": "7.0", "cvss": null, "severity": "" }, { "id": "CVE-2026-46298", "title": "pseries/papr-hvpipe: Fix race with interrupt handler", "description": "While executing ->ioctl handler or ->release handler, if an interrupt fires on the same cpu, then we can enter into a deadlock.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46298", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-46302", "title": "selinux: allow multiple opens of /sys/fs/selinux/policy", "description": "Currently there can only be a single open of /sys/fs/selinux/policy at any time. This allows any process to block any other process from reading the kernel policy. The original motivation seems to have been a mix of preventing an inconsistent view of the policy size and preventing userspace from allocating kernel memory without bound, but this is arguably equally bad. Eliminate the policy_opened f", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-46302", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-52949", "title": "drm/ttm: Fix ttm_bo_shrink() infinite LRU walk on backup failure", "description": "Apply the same fix as b2ed01e7ad (\"drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure\") to the ttm_bo_shrink() path.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52949", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-52965", "title": "drm/ttm: Fix ttm_bo_swapout() infinite LRU walk on swapout failure", "description": "When ttm_tt_swapout() fails, the current code calls ttm_resource_add_bulk_move() followed by ttm_resource_move_to_lru_tail() to restore the resource's bulk_move membership.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-52965", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53007", "title": "ice: fix potential NULL pointer deref in error path of ice_set_ringparam()", "description": "ice_set_ringparam nullifies tstamp_ring of temporary tx_rings, without clearing ICE_TX_RING_FLAGS_TXTIME bit. When ICE_TX_RING_FLAGS_TXTIME is set and the subsequent ice_setup_tx_ring() call fails, a NULL pointer dereference could happen in the unwinding sequence:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53007", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53008", "title": "ice: fix race condition in TX timestamp ring cleanup", "description": "Fix a race condition between ice_free_tx_tstamp_ring() and ice_tx_map() that can cause a NULL pointer dereference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53008", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53017", "title": "f2fs: fix data loss caused by incorrect use of nat_entry flag", "description": "Data loss can occur when fsync is performed on a newly created file (before any checkpoint has been written) concurrently with a checkpoint operation. The scenario is as follows:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53017", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53106", "title": "bpf: Do not allow deleting local storage in NMI", "description": "Currently, local storage may deadlock when deferring freeing selem or local storage through kfree_rcu(), call_rcu() or call_rcu_tasks_trace() in NMI or reentrant. Since deleting selem in NMI is an unlikely use case, partially mitigate it by returning error when calling from bpf_xxx_storage_delete() helpers in NMI. Note that, it is still possible to deadlock through reentrant. A full mitigation req", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53106", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53108", "title": "powerpc/64s: Fix unmap race with PMD migration entries", "description": "The following race is possible with migration swap entries or device-private THP entries. e.g. when move_pages is called on a PMD THP page, then there maybe an intermediate state, where PMD entry acts as a migration swap entry (pmd_present() is true). Then if an munmap happens at the same time, then this VM_BUG_ON() can happen in pmdp_huge_get_and_clear_full().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53108", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53124", "title": "ublk: reset per-IO canceled flag on each fetch", "description": "If a ublk server starts recovering devices but dies before issuing fetch commands for all IOs, cancellation of the fetch commands that were successfully issued may never complete. This is because the per-IO canceled flag can remain set even after the fetch for that IO has been submitted - the per-IO canceled flags for all IOs in a queue are reset together only once all IOs for that queue have been", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53124", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53222", "title": "ptp: ocp: fix resource freeing order", "description": "Commit a60fc3294a37 (\"ptp: rework ptp_clock_unregister() to disable events\") added a call to ptp_disable_all_events() which changes the configuration of pins if they support EXTTS events. In ptp_ocp_detach() pins resources are freed before ptp_clock_unregister() and it leads to use-after-free during driver removal. Fix it by changing the order of free/unregister calls. To avoid irq handler running", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53222", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53257", "title": "wifi: cfg80211: enforce HE/EHT cap/oper consistency", "description": "Xiang Mei reports that mac80211 could crash if eht_cap is set but eht_oper isn't. Rather than fixing that for the individual user(s), enforce that both HE/EHT have consistent elements.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53257", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53285", "title": "drm/amd/display: Wrap DCN32 phantom-plane allocation in DC_RUN_WITH_PREEMPTION_ENABLED", "description": "[Why] dcn32_validate_bandwidth() wraps dcn32_internal_validate_bw() with DC_FP_START()/DC_FP_END(). In x86 non-RT, DC_FP_START takes fpregs_lock(), which disables local softirqs.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53285", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53292", "title": "net: phonet: do not BUG_ON() in pn_socket_autobind() on failed bind", "description": "syzbot reported a kernel BUG triggered from pn_socket_sendmsg() via pn_socket_autobind():", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53292", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-53308", "title": "power: supply: max77705: Free allocated workqueue and fix removal order", "description": "Use devm interface for allocating workqueue to fix two bugs at the same time:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-53308", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-63811", "title": "f2fs: read COW data with the original inode during atomic write", "description": "When updating an atomic-write file, f2fs_write_begin() may read the previously written data back from the COW inode: prepare_atomic_write_begin() locates the block in the COW inode and sets use_cow, and the read bio is then built with the COW inode:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63811", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-63983", "title": "net/sched: fix packet loop on netem when duplicate is on", "description": "When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or memory is exhausted.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-63983", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64013", "title": "ACPI: button: Fix ACPI GPE handler leak during removal", "description": "Commit a7e23ec17fee (\"ACPI: button: Install notifier for system events as well\") changed the ACPI notify handler type for ACPI buttons to ACPI_ALL_NOTIFY, but it forgot to update acpi_button_remove() to reflect that change. This leads to leaking the notify handler past driver removal, which may cause a kernel crash to occur if ACPI notify on the given device is triggered after removing the driver,", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64013", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64019", "title": "nvme-pci: fix dma mapping leak on data setup error", "description": "We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing unmap helper because it depends on the tracking descriptor being successfully allocated, so a new one for an in-use iterator is provided.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64019", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64040", "title": "cachefiles: Fix error return when vfs_mkdir() fails", "description": "When vfs_mkdir() fails, the error code is not extracted from the returned error pointer. This causes mkdir_error to be reached with ret=0, which leads to returning ERR_PTR(0) (NULL) instead of a proper error pointer.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64040", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64079", "title": "netfilter: x_tables: allocate hook ops while under mutex", "description": "arp/ip(6)t_register_table() add the table to the per-netns list via xt_register_table() before allocating the per-netns hook ops copy via kmemdup_array(). This leaves a window where the table is visible in the list with ops=NULL.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64079", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64146", "title": "erofs: fix metabuf leak in inode xattr initialization", "description": "commit bb88e8da0025 (\"erofs: use meta buffers for xattr operations\") converted xattr operations to use on-stack erofs_buf instances. erofs_init_inode_xattrs() uses such a metabuf while reading the inline xattr header and shared xattr id array.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64146", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64154", "title": "drm/msm/adreno: Fix a reference leak in a6xx_gpu_init()", "description": "In a6xx_gpu_init(), node is obtained via of_parse_phandle(). While there was a manual of_node_put() at the end of the common path, several early error returns would bypass this call, resulting in a reference leak. Fix this by using the __free(device_node) cleanup handler to release the reference when the variable goes out of scope.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64154", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64159", "title": "netfs: Fix zeropoint update where i_size > remote_i_size", "description": "Fix the update of the zero point[*] by netfs_release_folio() when there is uncommitted data in the pagecache beyond the folio being released but the on-server EOF is in this folio (ie. i_size > remote_i_size). The update needs to limit zero_point to remote_i_size, not i_size as i_size is a local phenomenon reflecting updates made locally to the pagecache, not stuff written to the server. remote_i_", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64159", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64212", "title": "wifi: iwlwifi: mld: don't dereference a pointer before NULL checking it", "description": "In iwl_mld_remove_link, the link->fw_id is saved at the beginning of the function so we have it after we freed the link.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64212", "fixed_mainline": "7.1", "cvss": null, "severity": "" }, { "id": "CVE-2026-64283", "title": "KVM: guest_memfd: Treat memslot binding offset+size as unsigned values", "description": "When binding a memslot to a guest_memfd file, treat the offset and size as unsigned values to fix a bug where the sum of the two can result in a false negative when checking for overflow against the size of the file. Passing unsigned values also avoids relying on somewhat obscure checks in other flows for safety, and tracks the offset and size as they are intended to be tracked, as unsigned values", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64283", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-64325", "title": "wifi: mt76: mt7921/mt7925: fix NULL dereference in CSA beacon", "description": "This patch is based on a BUG as reported by Bongani Hlope at https://lore.kernel.org/all/20260502125824.425d7159@bongani-mini.home.org.za/", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64325", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-64341", "title": "USB: iowarrior: fix use-after-free on disconnect race", "description": "mutex_unlock() may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly (unlike spinlocks and refcounts). [1][2]", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-64341", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68086", "title": "mm/khugepaged: write all dirty file folios when collapsing", "description": "[There is no upstream commit, as this code was removed by upstream commit 044925f9b565 (\"mm: fs: remove filemap_nr_thps*() functions and their users\")]", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68086", "fixed_mainline": "", "cvss": null, "severity": "" }, { "id": "CVE-2026-68105", "title": "drm/amdgpu: Fix kernel panic during driver load failure", "description": "Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68105", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68242", "title": "drm/i915/gt: Fix NULL deref on sched_engine alloc failure", "description": "Avoid using intel_context_put() before intel_context_init() in execlists_create_virtual() as the kref_put() inside would lead to NULL deref on the IOCTL path when sched_engine allocation fails.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68242", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68291", "title": "idpf: fix max_vport related crash on allocation error during init", "description": "Set adapter->max_vports only after successful allocation of vports, netdevs and vport_config buffers. This fixes possible crashes on reset or rmmod, following failed allocation on init", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68291", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68312", "title": "cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths", "description": "In cifs_close_deferred_file(), cifs_close_all_deferred_files(), and cifs_close_deferred_file_under_dentry(), when a pending deferred close is cancelled via cancel_delayed_work(), the subsequent kmalloc_obj() to add the file to the local processing list may fail under memory pressure. The loop breaks immediately, but the cancelled work is no longer pending (it would have called _cifsFileInfo_put())", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68312", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68375", "title": "bnxt_en: Handle partially initialized auxiliary devices", "description": "bnxt_aux_devices_init() calls auxiliary_device_init() before all fields used by bnxt_aux_dev_release() are initialized. After auxiliary_device_init() succeeds, later errors must unwind with auxiliary_device_uninit(), which invokes the release callback.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68436", "title": "drm/amd/display: use kvzalloc to allocate struct dc", "description": "struct dc has grown large over time (most of it the two inlined dc_scratch_space copies) and now sits close to the page allocator's 4 MiB contiguous allocation limit. Its actual size is not fixed by the source alone, it also depends on the compiler and the .config, so it can easily cross 4 MiB, e.g. with a newer GCC or a config change.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68436", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-68441", "title": "net/sched: Handle TC_ACT_REDIRECT from qdisc filter chains", "description": "When a TC filter attached to a qdisc filter chain returns TC_ACT_REDIRECT (ex: via an eBPF program calling bpf_redirect() or an act_bpf action), the redirect was silently lost i.e no qdisc classify function handled TC_ACT_REDIRECT, so the packet fell through the switch and was enqueued normally instead of being redirected.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-68441", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72031", "title": "ata: libata-core: Add NOLPM quirk for PNY CS900 1TB SSD", "description": "The PNY CS900 1TB SSD (Phison PS3111-S11, DRAM-less) drops off the bus after entering Device-Initiated Slumber during idle. With the default med_power_with_dipm policy the link goes down (SStatus 1 SControl 300) and does not recover, forcing the filesystem read-only. Forcing max_performance keeps the link stable across prolonged idle.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72031", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72091", "title": "accel/amdxdna: reject user command submission without a command BO", "description": "amdxdna_drm_submit_execbuf() passes the user-supplied command BO handle straight into amdxdna_cmd_submit() with drv_cmd == NULL. When the handle is AMDXDNA_INVALID_BO_HANDLE (0), the block that fetches job->cmd_bo is skipped, leaving it NULL, and no check rejects it on the user path (the !job->cmd_bo guard lives inside the != INVALID branch).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72091", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72337", "title": "Bluetooth: 6lowpan: avoid untracked enable work", "description": "lowpan_enable_set() allocates a temporary work item and schedules do_enable_set() on system_wq, then returns to debugfs. The debugfs active operation has ended at that point, but the worker still executes module text and manipulates enable_6lowpan and listen_chan.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72337", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72370", "title": "iomap: release pages on atomic dio size mismatch", "description": "If bio_iov_iter_get_pages() or the bounce helper succeeds but builds a short bio, the REQ_ATOMIC size check rejects it before submission. The old error path only dropped the bio reference, leaving any pages already attached to the bio unreleased.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72370", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72377", "title": "afs: Remove setting of AS_RELEASE_ALWAYS for symlinks and mountpoints", "description": "Regular AFS files correctly use afs_file_aops which have release_folio set as netfs_release_folio, so AS_RELEASE_ALWAYS is valid for them when fscache is enabled (set via afs_vnode_set_cache()). Symlinks and mountpoints in AFS use afs_dir_aops, which does not provide a release_folio callback. However, afs_apply_status() unconditionally calls mapping_set_release_always() for these.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72377", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72388", "title": "drm/panthor: Always use the IRQ-safe variant when acquiring the fence lock", "description": "Since dma_fence objects can be shared with other subsystems, they may be accessed from hardirq context in those drivers, and we have to take that into account by also using the IRQ-safe variant when acquiring the lock.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72388", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-72439", "title": "md/raid10: fix writes_pending leak on write request failures", "description": "raid10_make_request() acquires a writes_pending reference with md_write_start() before dispatching write requests. Several failure paths in raid10_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-72439", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74272", "title": "cxl/region: Resolve region deletion races", "description": "Sungwoo noticed that the sysfs trigger to delete a region may try to delete a region multiple times. It also has no exclusion relative to the kernel releasing the region via CXL root device teardown.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74272", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74273", "title": "cxl/region: Block region delete during region creation", "description": "Expand the range lock, rename it \"regions_lock\", to disable region deletion in the critical period between construct_region() and attach_target(), as well as the period between device_add() and registering the remove actions.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74273", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74307", "title": "ext4: validate donor file superblock early in EXT4_IOC_MOVE_EXT", "description": "Reject the EXT4_IOC_MOVE_EXT ioctl early if the donor file does not belong to the same superblock as the original file. Currently, this validation is performed inside ext4_move_extents() by mext_check_validity(), but only after lock_two_nondirectories() has already acquired the inode locks. When the donor fd refers to a file on a different filesystem (e.g., overlayfs), this late validation creates", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74307", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74336", "title": "wifi: mac80211: bound S1G TIM PVB walk to the TIM element", "description": "ieee80211_s1g_check_tim() parses the S1G Partial Virtual Bitmap (PVB) of a received TIM element. The TIM is handed in as the element payload: ieee802_11_parse_elems_full() stores elems->tim = elem->data and elems->tim_len = elem->datalen (net/mac80211/parse.c), so the valid bytes are [tim, tim + tim_len).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74336", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74342", "title": "kernfs: link kn to its parent before the LSM init hook", "description": "After commit 12e9e3cd03b5 (\"simpe_xattr: use per-sb cache\"), kernfs_xattr_set() and kernfs_xattr_get() compute the cache via kernfs_root(kn) before any other check. kernfs_root(kn) walks kn->__parent first and falls back to kn->dir.root, both of which are NULL on a freshly kmem_cache_zalloc()'d kn. kn->__parent was being set in kernfs_new_node() after __kernfs_new_node() returned, and kn->dir.root", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74342", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74368", "title": "wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()", "description": "In ath12k_wifi7_dp_rx_h_verify_tkip_mic(), the call to ath12k_dp_rx_check_nwifi_hdr_len_valid() may return false when the NWIFI header length is invalid, causing the function to abort early with -EINVAL.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74368", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74373", "title": "md/raid1,raid10: fix bio accounting for split md cloned bios", "description": "Use md_cloned_bio() to control bio accounting instead of relying on r1bio_existed in raid1 or the io_accounting flag in raid10.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74373", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74375", "title": "md/raid1,raid10: fix deadlock in read error recovery path", "description": "raid1d and raid10d may resubmit a split md cloned bio while handling a read error. In this case, resubmitting the bio can lead to a deadlock if the array is suspended before md_handle_request() acquires an active_io reference via percpu_ref_tryget_live().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74375", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74466", "title": "s390/zcrypt: Close speculative mem read possibility", "description": "The domain value is extracted from a given CCA or EP11 ioctl struct when a CPRB is about to be sent. Thus this is a user controlled value. Under some special conditions (custom device node used, administrative load) this value is used as an array index after bounds checking, but without speculation barrier.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74466", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74542", "title": "netfs: Fix folio_queue ENOMEM in writeback by adding a mempool", "description": "Fix the handling of folio_queue allocation failure in writeback by adding a mempool and passing in gfp_t flags to the rolling buffer functions that allocate memory, using the mempool if gfp != GFP_KERNEL.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74542", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74558", "title": "xsk: reclaim invalid Tx descriptors in ZC batch path", "description": "The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past fragments that are neither submitted to the driver nor returned to userspace through the completion ring.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74558", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74571", "title": "btrfs: skip global block reserve accounting for rescue mounts", "description": "[BUG] Mounting with rescue=ibadroots after corrupting the block group tree root triggers a NULL pointer dereference:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74571", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74716", "title": "accel/amdxdna: Fix locally exploitable BUG_ON in amdxdna_insert_pages()", "description": "In amdxdna_insert_pages(), vm_flags_mod() sets VM_MIXEDMAP and clears VM_PFNMAP. If an unprivileged userspace process mmaps a non-imported GEM object and then calls madvise(MADV_DONTNEED), the PTEs will be successfully cleared because VM_MIXEDMAP allows this (unlike VM_PFNMAP).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74716", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74729", "title": "soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_read", "description": "put_fifo_with_discard() acts as both producer and consumer on the kfifo: it calls kfifo_skip() (advances out) and kfifo_put() (advances in) from the IRQ handler without synchronizing with snoop_file_read(), which also consumes via kfifo_to_user(). On SMP systems this concurrent access can leave (in - out) larger than the ring buffer, so __kfifo_to_user()'s clamp to (in - out) is ineffective and kf", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74729", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74732", "title": "drm/amd/display: Check for tg ops in dce110_set_avmute", "description": "Some older DCE timing generators do not implement is_tg_enabled in their ops table. Calling it unconditionally when waiting for AV mute frames causes a NULL pointer dereference on Southern Islands dGPUs when turning the display off over HDMI.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74732", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-74754", "title": "scsi: core: pair EH runtime PM get and put", "description": "shost->eh_noresume is currently consulted twice in one error handling iteration: once before scsi_autopm_get_host() and once again before scsi_autopm_put_host().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-74754", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80524", "title": "optee: ffa: Add NULL check in optee_ffa_lend_protmem", "description": "Sashiko (locally) reports a possible null dereference under memory pressure due to the lack of validation of the allocated pointer.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80524", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80655", "title": "soc: xilinx: Fix race condition in event registration", "description": "The zynqmp_power driver registers handlers for suspend and subsystem restart events using register_event(). However, the work structures (zynqmp_pm_init_suspend_work and zynqmp_pm_init_restart_work) used by these handlers were allocated and initialized after the registration call.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80655", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80657", "title": "accel/amdxdna: Guard management mailbox channel cleanup against NULL pointer", "description": "The management mailbox channel cleanup helpers can be called from error handling paths when mgmt_chann has already been destroyed.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80657", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80698", "title": "dmaengine: idxd: fix double free of wq, engine, and group structs", "description": "The release callbacks for wq, engine, and group devices (idxd_conf_wq_release, idxd_conf_engine_release, idxd_conf_group_release) each call kfree() on the enclosing struct. The setup error paths and cleanup functions also call kfree() explicitly after put_device(), producing a double free whenever put_device() drops the reference count to zero and fires the release.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80698", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80705", "title": "drm/amd/display: check if dml21_add_phantom_plane() is successful", "description": "Verify that the phantom plane was allocated to avoid a later segfault.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80705", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80728", "title": "Revert \"drm/amdgpu: fix aperture mapping leak\"", "description": "devres teardown is LIFO. The aperture devres node was registered after the DRM device node, so devres_release_all() unmaps the aperture before the DRM device release callback fires amdgpu_device_fini_sw(). IP sw_fini callbacks (e.g. vcn_v4_0_sw_fini) write to fw_shared through a pointer derived from aper_base_kaddr, causing a kernel page fault on probe failure / rollback:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80728", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80729", "title": "mm/huge_memory: initialise workingset state before folio split", "description": "xas_try_split() adds __GFP_ACCOUNT for page-cache xa_nodes, but __folio_split() leaves the xa_state's xa_lru unset. That lets a live, memcg-charged xa_node exist without being linked into the mapping's shadow_nodes list_lru; when reclaim later walks the list_lru it trips VM_WARN_ON(!css_is_dying()).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80729", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80785", "title": "fbdev: serialize mode sysfs access with lock_fb_info()", "description": "show_mode(), show_modes(), and store_mode() access fb_info->modelist and fb_info->mode without holding lock_fb_info(). store_modes() takes lock_fb_info() while replacing the modelist and freeing the old one.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80785", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80786", "title": "fbdev: Wrap user-invoked calls to fb_set_var() in helper", "description": "Handle fbcon during display updates in fb_set_var_from_user(). Check with fbcon if the mode change is possible, update hardware state and finally update fbcon. Update all callers.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80786", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80866", "title": "tipc: avoid busy looping in tipc_exit_net()", "description": "Blamed commit introduced a busy-wait loop in tipc_exit_net() to wait for pending UDP bearer cleanup works to complete:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80866", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80884", "title": "ntb: Store original DMA address for future release", "description": "The DMA API requires that dma_free_attrs receive the exact dma_handle originally returned by the allocation function. Do not modify it.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80884", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-80899", "title": "erofs: remove fscache backend entirely", "description": "EROFS over fscache was introduced to provide image lazy pulling functionality. After the feature landed, the fscache subsystem made netfs a new hard dependency, which is unexpected for a local filesystem and has an kernel-defined caching hierarchy which could be inflexible compared to the fanotify pre-content hooks. Therefore, this feature has been deprecated for almost two years.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-80899", "fixed_mainline": "7.2", "cvss": null, "severity": "" }, { "id": "CVE-2026-89527", "title": "svcrdma: Use svc_xprt_put to free listener on create failure", "description": "svc_rdma_create() calls kfree(cma_xprt) when svc_rdma_create_listen_id() fails. svc_xprt_init() has already acquired a net namespace reference via get_net_track(); kfree bypasses svc_xprt_free() which releases it.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89527", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89568", "title": "kho: fix size calculation in kho_preserved_memory_reserve()", "description": "kho_preserved_memory_reserve() calculates the size of a preservation by doing 1 << (order + PAGE_SHIFT). Since the '1' is a 32-bit integer, it can only be shifted by 31. That is, it will only work for preservations up to 2 GiB. Larger preservations will trigger undefined behaviour.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89568", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89623", "title": "HID: mcp2221: stop device IO before hid_hw_stop", "description": "Quiesce device IO at the start of the devm cleanup callback mcp2221_hid_unregister() so that incoming HID reports cannot race with hardware teardown during probe failure or device removal, addressing a potential use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89623", "fixed_mainline": "", "cvss": null, "severity": "" }, { "id": "CVE-2026-89642", "title": "cifs: call pagecache_isize_extended() in cifs_setsize() when extending", "description": "cifs_setsize() calls truncate_pagecache() but skips pagecache_isize_extended() on extension. truncate_setsize() shows the correct pattern:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89642", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89673", "title": "nfsd: fix XDR padding calculation in ff_encode_getdeviceinfo", "description": "nfsd4_ff_encode_getdeviceinfo() computes the da_addr_body reservation as 16 + netid_len + addr_len, but the subsequent xdr_encode_opaque() calls emit 8 + round_up(netid_len, 4) + round_up(addr_len, 4) bytes. The mismatch means the declared da_addr_body length exceeds the actual encoded data by 2-8 bytes on every flexfile GETDEVICEINFO reply, leaking stale reply-page content to the client and mis-a", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89673", "fixed_mainline": "", "cvss": null, "severity": "" }, { "id": "CVE-2026-89718", "title": "zram: fix out-of-bounds access in writeback_store()", "description": "Patch series \"zram: fix stale scan bounds after reinitialization\".", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89718", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89772", "title": "btrfs: write-protect folios during data writeback", "description": "commit 095be159f3eb (\"btrfs: unify folio dirty flag clearing\") replaced the folio_clear_dirty_for_io() call in extent_write_cache_pages() with a plain folio_test_dirty() check. Besides clearing the dirty flag, folio_clear_dirty_for_io() also calls folio_mkclean(), which write-protects the shared mmap PTEs mapping the folio. Note that we still do call folio_clear_dirty_for_io() later in submit_one_", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89772", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89812", "title": "drm/amdgpu: force complete the MES ring fences on reset", "description": "The MES scheduler ring has no drm scheduler (no_scheduler = true), so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). It uses a polling fence whose hw value lives in wb (GTT) memory and survives a MODE1 reset, while fence_drv.sync_seq keeps advancing for every packet.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89812", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89813", "title": "drm/amdgpu: force complete the KIQ ring fences on reset", "description": "Like the MES scheduler ring, the KIQ ring sets no_scheduler = true and uses a polling fence, so it is skipped by the force-completion loop in amdgpu_device_pre_asic_reset(). Its hw fence value lives in wb (GTT) memory and survives a MODE1 reset while fence_drv.sync_seq keeps advancing, so after a reset the first KIQ submission can poll forever on a seq that is never written back.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89813", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89862", "title": "scsi: qla2xxx: Fix BSG job leak on validate flash image error path", "description": "qla28xx_validate_flash_image() returns QLA_SUCCESS (0) unconditionally, telling the FC BSG transport (fc_bsg_host_dispatch()) that the driver owns and will complete the request. But bsg_job_done() is guarded by \"if (!rval)\", so on the error path (rval == -EINVAL) neither the driver nor the transport completes the job. The request dangles until it times out, leaking block layer resources.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89862", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-89866", "title": "media: chips-media: wave5: Resume device before setting EOS flag", "description": "Setting the EOS flag talks to the firmware via send_firmware_command(), which accesses VPU registers. Both the STREAMOFF path (wave5_vpu_dec_job_abort()) and the V4L2_DEC_CMD_STOP path (wave5_vpu_dec_stop()) can run while the device is runtime suspended, so those register accesses hit powered-down hardware and the SoC raises an asynchronous SError, panicking the kernel:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-89866", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90040", "title": "KVM: SEV: Forcefully invalidate SNP VMSA if its backing gmem page is zapped", "description": "Wire up a gmem_invalidate_range() call for SNP VMs, and use it to force vCPUs to reload/recheck their guest-provided VMSA if the backing gmem page is being invalidated, e.g. is being PUNCH_HOLE'd. Use the same core logic to handle invalidations as VMX does for the APIC-access page, as the two concepts are nearly identical: shove the physical address of a page into the vCPU's control structure:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90040", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90061", "title": "netfilter: nf_tables: skip double clone set expressions on element insert", "description": "Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This results in a double clone, once to clone the template set expressions then another clone on the new element. Add a flag to annotate if userspace provides a override expression (ie. expression of the same type of the set but different configuratio", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90061", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90079", "title": "octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()", "description": "rvu_mbox_init() is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ng_rvu object, leaking the first allocation when the pointer was overwritten on the second call.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90079", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90082", "title": "net: mana: Cap MSI-X vectors to the device MSI-X table size", "description": "mana_gd_query_max_resources() sizes gc->num_msix_usable from resp.max_msix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793 while the table has 1024 entries, and mana_gd_setup_remaining_irqs() then walks indices 1..1792, running off the end of the region mapped by msix_map_region():", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90082", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90087", "title": "Bluetooth: do not leak an hci_conn when a second LE connect is rejected", "description": "create_le_conn_complete() decides whether the failed connection is still pending by comparing it against hci_lookup_le_connect(), which returns the first LE connection in BT_CONNECT. That is the same connection only while at most one is pending.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90087", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90095", "title": "fuse: Fix the condition to enable over-io-uring", "description": "The existing condition in fuse_uring_cmd() is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORING_OP_URING_CMD if the connection/channel didn't get enabled because of missing FUSE_INIT reply flag FUSE_OVER_IO_URING. Without the reply flag the barrier in fuse_uring_ready() doesn't work and IO could already be going on and cau", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90095", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90098", "title": "net: sparx5: fix sleep in atomic context in MAC table access", "description": "sparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates dev->mc via __dev_mc_sync(), which per address calls sparx5_mc_sync() / sparx5_mc_unsync() -> sparx5_mact_learn() / sparx5_mact_forget(). These take sparx5->lock, a mutex, and then poll the MAC access command register with readx_poll_timeout(). A mutex may block, which is not allowed from atomic context.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90098", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90099", "title": "net/sched: account classifier filter allocations to memcg", "description": "Allocations in the tc classifier *_change() paths (filter objects, per-CPU counters, and per-filter aux data) use plain GFP_KERNEL without __GFP_ACCOUNT, allowing unprivileged users to pin kernel memory outside memcg charging. The shared tcf_exts_init_ex() action array allocation in cls_api.c was also uncharged; this patch closes it along with the per-classifier filter-object/percpu/aux allocation", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90105", "title": "vxlan: fix reading neigh ha", "description": "Currently arp/neigh_reduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address similar to route_shortcircuit which already does the right thing.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90105", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90106", "title": "net: bridge: arp/nd proxy: fix reading neigh ha", "description": "Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neigh_ha_snapshot to take a stable snapshot of the address.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90106", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90121", "title": "irqchip/gic-v5: Clear per-CPU IRS data on teardown", "description": "IRS affinity setup publishes an IRS pointer and IAFFID state in the per-CPU data before the remaining IRS initialization can fail. The error path then frees the IRS data without clearing that published state, leaving CPUs associated with freed memory.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90121", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90144", "title": "dpll: fix NULL deref in dpll_device_ops() during teardown race", "description": "When the last owner of a dpll device unregisters while a foreign driver still holds a pin on it via dpll_pin_on_pin_register(), the dpll object stays alive with an empty registration list. A pin notification queued before the unregister (e.g. ice reacting to zl3073x_i2c removal) then walks pin->dpll_refs into dpll_device_ops(), which trips the WARN_ON and dereferences the missing registration. dpl", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90144", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90154", "title": "ksmbd: scope session state changes to bound connections", "description": "ksmbd_all_conn_set_status() treats every connection whose transient binding flag is set as belonging to the target SessionId. A logoff or session replacement can consequently move an unrelated connection to NEED_RECONNECT or NEED_SETUP.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90154", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90155", "title": "ksmbd: detach blocked lock requests before freeing", "description": "A file_lock retained by ksmbd for byte-range lock bookkeeping can still be part of the VFS blocked-request graph. In particular, the VFS can chain a new waiter below an already blocked request through flc_blocked_requests. The ksmbd_file reference count does not cover that graph.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90155", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90156", "title": "ksmbd: safely discard unregistered deferred locks", "description": "When vfs_lock_file() defers a lock, smb2_lock() puts its ksmbd_lock on rollback_list before allocating and registering the asynchronous work. If either operation fails, rollback assumes that smb_lock->conn is initialized and dereferences NULL. The deferred file_lock also remains linked into the VFS blocked-lock state while it is freed.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90156", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90167", "title": "ksmbd: serialize oplock close with pending break ownership", "description": "close may abort an in-flight oplock break while another breaker already holds an opinfo reference. Releasing pending_break wakes that waiter, but without serializing the close transition with bit acquisition it can become a new break owner through the test_and_set_bit() fast path. It can then overwrite OPLOCK_CLOSING with OPLOCK_ACK_WAIT and continue a break for a dying opinfo.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90167", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90182", "title": "blk-iocost: clear delay state when freeing policy data", "description": "iocg_kick_delay() turns sufficiently large debt into an explicit block-cgroup delay with blkcg_set_delay(), setting blkg->use_delay to -1 and incrementing blkcg->congestion_count. Clearing it again depends on iocg_kick_delay() running from the period timer, the waitq timer or the issue path.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90182", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90183", "title": "blk-iolatency: clear delay state when freeing policy data", "description": "io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, check_scale_change() scales down its peers, and a peer that reaches queue depth one gets blkcg_use_delay() called on it on every further scale-down, even with min_lat_nsec == 0.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90183", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90206", "title": "nvmet: fix max_qid race between configfs and controller allocation", "description": "The function nvmet_subsys_attr_qid_max_store() can race against nvmet_alloc_ctrl() when a subsystem's max_qid limit is modified.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90206", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90208", "title": "clocksource/drivers/samsung_pwm: Switch to raw_spinlock_t type", "description": "Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPT_RT is enabled on ARM, regular spinlock is converted to a sleeping lock (mutex-based), which must not be used in atomic context such as hard interrupt handlers. Switch the samsung_pwm_lock to the raw_spinlock, which remains a true non-sleeping spinlock even under PREEMPT_RT.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90208", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90211", "title": "bpf, s390: Clear fetch destination on faulting arena atomic", "description": "Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPF_PROBE_ATOMIC and gets an exception table entry, but bpf_jit_probe_atomic_pre() only fills in the arena base and the probe offset, leaving probe->reg at the -1 that bpf_jit_probe_init() set, which bpf_jit_probe_post() writes into the entry and ex_handler_bpf() then reads back as \"there is nothing to clea", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90211", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90242", "title": "iommu/vt-d: Fix iopf_refcount leak on RID domain replacement", "description": "intel_iommu_attach_device() enables IOPF for the new domain but never disables it for the old one. device_block_translation(), called at the start of the function, tears down translation but does not touch any IOPF state; blocking_domain_attach_dev() has to call iopf_for_domain_remove() explicitly before invoking it for exactly this reason.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90242", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90261", "title": "btrfs: zoned: flush active metadata block group at btree_writepages() start", "description": "btree_writepages() writes the btree inode's dirty metadata in ascending logical address order. On a zoned filesystem only one metadata and one system block group is active for writing at a time, and check_bg_is_active() (via btrfs_check_meta_write_pointer()) pivots the active block group as writeback moves from one block group to the next.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90261", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90263", "title": "btrfs: check if root is readonly when setting posix acl", "description": "For a filesystem which has btrfs read-only property set to true, all write operations including acl and xattr should be denied. However, acl can still be set even if btrfs ro property is true.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90263", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90267", "title": "scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails", "description": "sd_set_special_bvec() allocates a special payload page for UNMAP and WRITE SAME commands. If scsi_alloc_sgtables() fails afterward in sd_setup_unmap_cmnd() or sd_setup_write_same{10,16}_cmnd(), the SCSI midlayer does not call uninit_command() because RQF_DONTPREP is not set yet, leaking the page.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90267", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90273", "title": "coresight: etm4x: missing cscfg_csdev_disable_active_config() in perf enable", "description": "In the perf enable path, there are missing cases where cscfg_csdev_disable_active_config() is not called:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90273", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90300", "title": "bpf: Clear buf on error in __bpf_get_task_stack", "description": "Both bpf_get_task_stack and bpf_get_task_stack_sleepable helpers that use __bpf_get_task_stack have buf defined as ARG_PTR_TO_UNINIT_MEM argument and we should initialize the buf on every return path.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90300", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90311", "title": "thermal: hwmon: Remove hwmon class device along with its parent", "description": "The current code creates one hwmon device per thermal zone type and that device is registered under the first thermal zone of the given type.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90311", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90315", "title": "PCI/sysfs: Add lockdown checks to legacy I/O and memory handlers", "description": "Currently, the legacy I/O and memory sysfs handlers do not check security_locked_down(LOCKDOWN_PCI_ACCESS), leaving the legacy_io and legacy_mem files unprotected when the kernel is locked down.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90315", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90323", "title": "ublk: validate auto buf reg before taking uring_cmd", "description": "With UBLK_F_AUTO_BUF_REG, invalid sqe->addr can fail after ublk_fill_io_cmd() has set UBLK_IO_FLAG_ACTIVE. The uring_cmd is completed while the tag stays active, which can hang teardown.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90323", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90330", "title": "HID: logitech-hidpp: Fix FF device cleanup on init failure", "description": "hidpp_ff_init() creates the input force-feedback device with input_ff_create(), then allocates the HID++ FF private data, effect ID array, and workqueue.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90330", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90335", "title": "tty: skip cdev_del() when no cdev is registered", "description": "TTY device registration can fail before a cdev is allocated. Serial core keeps the port so setserial can still use it, and later removal passes the NULL cdev slot to cdev_del(), causing a NULL-pointer dereference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90335", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90336", "title": "serial: core: clear freed pointers on uart_register_driver() failure", "description": "uart_register_driver() leaves drv->state pointing to freed memory when tty_alloc_driver() fails. If tty_register_driver() fails, drv->tty_driver also retains a pointer after its reference is dropped.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90336", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90337", "title": "serial: core: do fallible allocations before the console can be registered", "description": "serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90337", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90345", "title": "wifi: brcmfmac: fix P2P action frame handling without device vif", "description": "Some P2P action frame paths assume the P2P device vif is always available. That is not true when userspace sends non-P2P public action frames through the primary interface, or when action-frame abort runs after the P2P device vif has not been created.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90345", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90346", "title": "wifi: nl80211: clean up color-change beacon data on errors", "description": "nl80211_color_change() calls nl80211_parse_beacon() for the beacon_next template, which can allocate params.beacon_next.mbssid_ies and .rnr_ies. A parsing failure returned directly instead of using the out: cleanup, leaking any allocations completed before the error.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90346", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90355", "title": "wifi: mt76: mt7996: clear stale link state on full reset", "description": "After a full chip reset, mac80211 reconfig replays interface, link and channel context setup. mt7996_vif_link_add() short-circuits when the link_id is still marked in mvif->valid_links, a state introduced for postponing link teardown to interface removal. The reset path frees the link structures without clearing those bits, so the replayed setup never re-creates dev_info/bss_info/STA records in th", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90355", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90359", "title": "bpf: Reject >8 byte return values on return-reading trampoline paths", "description": "btf_distill_func_proto() builds the function model used for the fentry/fexit/fmod_ret/fsession trampolines and struct_ops. It has accepted a 16-byte __int128 return value since the trampoline was introduced: __get_type_size() returns the integer's type size, and the return-type check only rejected ret < 0.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90359", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90365", "title": "wifi: mt76: cancel reset and rc work on device unregister", "description": "Both drivers cancelled dump_work on unregister but left reset_work and rc_work to be flushed only by destroy_workqueue() in mt76_free_device(), which runs after the hw is unregistered and the hardware stopped. A reset_work that fires in that window calls ieee80211_restart_hw() and re-arms mac_work on an unregistered hw, and rc_work touches station state being torn down. Cancel both up front, along", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90365", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90409", "title": "drm/panthor: Add vm_bind region with kbo range overlap check", "description": "When a VM is created, caller has to specify the range of the address space carve-out set aside for mapping kernel BO's. That means vm_bind mappings of UM-exposed BO's should not intersect with that region, but at the moment we're not checking this.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90409", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90412", "title": "nvmet: fix return status of RMI log page on allocation failure", "description": "nvmet_execute_get_log_page_rmi() leaves 'status' holding NVME_SC_SUCCESS (set by the successful nvmet_req_find_ns() call) when the kzalloc() for the log buffer fails. It then jumps to the out label and completes the request with a success status, so the host is told the command succeeded while no data was transferred.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90412", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90417", "title": "RDMA/cxgb4: Fix dereg_skb leak and double free in write_tpt_entry()", "description": "When the device is in the fatal error state, write_tpt_entry() returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure returns do the same. c4iw_dereg_mr() ignores the error and frees mhp, leaking mhp->dereg_skb. c4iw_get_dma_mr() instead frees the skb a second time after dereg_mem() already consumed it, a double free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90417", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-90421", "title": "PCI: Fix UAF when probe runs concurrent to dyn ID removal", "description": "Dynamic IDs are only guaranteed to be valid when dynids.lock is held, as remove_id_store() can free the node. Thus, make a copy in pci_match_device(). Also, clarify that the id parameter is only valid during probe.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-90421", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92480", "title": "scsi: ufs: core: Validate string descriptors", "description": "The string descriptor length includes a two-byte header while the UTF-16 payload starts after it. utf16s_to_utf8s() expects a count of UTF-16 code units, not bytes. Passing the payload byte count can make it read beyond the descriptor buffer.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92480", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92482", "title": "pinctrl: mediatek: use devm_gpiochip_add_data() for GPIO chip", "description": "The gpio_chip is allocated with device-managed memory but registered with the non-managed gpiochip_add_data(). This was harmless while the drivers were built-in, but once they can be built as modules and unbound/rmmod'd, devm frees the gpio_chip's memory while it is still registered, causing a use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92482", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-92503", "title": "ext4: fix ABBA deadlock in ext4_xattr_inode_cache_find()", "description": "Syzbot/stress-ng reported an ABBA deadlock in ext4 when exercising concurrent xattr workloads (using the ea_inode mount/format option).", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-92503", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93044", "title": "bpf: Disallow interpreter fallback for arena-related insns", "description": "Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::__bpf_prog_select_runtime().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93044", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93047", "title": "drm/v3d: Associate BOs with every job that accesses them", "description": "A submission can expand into a chain of jobs (e.g. bin + render + cache clean). Implicit synchronization in v3d_submit_lock_reservations() is gated on each job's bo[], but the BO list was only ever attached to the last job of the chain. When that last job is a trailing CACHE_CLEAN job, the job that actually consumes the BOs (that is, a RENDER or CSD job) was left with bo_count == 0 and picked up n", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93047", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93081", "title": "firmware: arm_scmi: Fix SCMI device destroy lifetimes", "description": "scmi_child_dev_find() drops the reference returned by device_find_child() before returning the scmi_device pointer. A concurrent unregister can then release the device while the destroy path is still using the returned pointer.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93081", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93096", "title": "cxl/features: Serialize multi-part Get/Set Feature transfers", "description": "A Get or Set Feature payload larger than the mailbox payload size is split into several mailbox commands. mbox_mutex only serializes individual mailbox commands and is dropped between iterations of these loops. Nothing serializes the multi-part transfer as a whole. cxl_get_feature() and cxl_set_feature() are reachable concurrently from fwctl (per-fd RPCs run under a read-held registration lock) an", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93096", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93099", "title": "fs/resctrl: Fix UAF from worker threads when domains are removed", "description": "The mbm_handle_overflow() and cqm_handle_limbo() workers read event counters and may sleep while doing so. They are scheduled via delayed_work embedded in struct rdt_l3_mon_domain. Architecture allocates and frees these domains from CPU hotplug callbacks under cpus_write_lock(), and the workers acquire cpus_read_lock() to keep the domain alive across their access.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93104", "title": "RDMA/rvt: Return NULL after port allocation failure", "description": "rvt_alloc_device() deallocates the IB device when its port array cannot be allocated but then returns the pointer to the released allocation. Callers treat any non-NULL value as valid and dereference it, resulting in a use-after-free.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93104", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93129", "title": "platform/x86: dell-wmi-base: Fix handling of ultra performance key", "description": "The commit message of commit 5fbd827eb9c2 (\"platform/x86: dell-wmi: Recognise or support new switches\") states that the ultra performance key contains additional data after the type and code fields. The event data passed to dell_wmi_process_key() is already parsed, so \"buffer\" already starts after those two fields.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93129", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93135", "title": "bpf: Reject programs with inlined helpers if JIT is not available", "description": "When an architecture (such as LoongArch, ARM64, and RISC-V) implements bpf_jit_inlines_helper_call(), the verifier skips rewriting the helper call offset (insn->imm) in bpf_do_misc_fixups(). This is because the helper is expected to be inlined by the JIT compiler later. Therefore, insn->imm remains as the raw helper enum ID.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93135", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93164", "title": "uprobes/x86: Move optimized uprobe from nop5 to nop10", "description": "Andrii reported an issue with optimized uprobes [1] that can clobber redzone area with call instruction storing return address on stack where user code may keep temporary data without adjusting rsp.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93164", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93168", "title": "dmaengine: xilinx_dma: Fix CPU stall in xilinx_dma_poll_timeout", "description": "Currently when calling xilinx_dma_poll_timeout with delay_us=0 and a condition that is never fulfilled, the CPU busy-waits for prolonged time and the timeout triggers only with a massive delay causing a CPU stall.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93168", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93179", "title": "drm/amd/powerplay: fix VoltageObjectInfo zero-stride loop and OOB read", "description": "Reject voltage objects whose usSize is smaller than the header or would advance the cursor past the table end, preventing an infinite loop or heap OOB read when the VBIOS supplies a malformed VoltageObjectInfo table.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93179", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93181", "title": "perf/x86/intel/uncore: Fix uncore_box ref/unref ordering", "description": "In uncore_event_cpu_online(), uncore_box_ref() was called before uncore_change_context(). uncore_box_ref() gates on box->cpu >= 0, but box->cpu is still -1 at that point because uncore_change_context() has not run yet. As a result, the box is never initialized on the first CPU to come online in a die, leaving it permanently uninitialized in the single-CPU-per-die case.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93181", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93216", "title": "mm/page_owner: use memcg_data snapshot to avoid TOCTOU in print_page_owner_memcg()", "description": "print_page_owner_memcg() reads page->memcg_data via READ_ONCE() at the start to guard against tail pages and NULL data. However, it later re-reads page->memcg_data locklessly in two places:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93216", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93248", "title": "drm/xe: don't WARN on kernel job timeout when device already wedged", "description": "igt@xe_wedged@wedged-at-any-timeout wedges the device in mode 2 (UPON_ANY_HANG_NO_RESET) and then rebinds the driver. During unbind, a GSC proxy kernel submission can still time out; with the device wedged and the GuC CT stopped it can never complete, so its kernel job times out.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93248", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93251", "title": "ACPI: bus: Introduce acpi_bus_get_primary_device()", "description": "The function used for obtaining the first \"physical\" device for which the given ACPI one is the ACPI companion, acpi_get_first_physical_node(), may return a stale device pointer (mostly in theory) because acpi_unbind_one() may run as a whole after dropping the ACPI device's physical_node_lock in acpi_get_first_physical_node() and before it returns. The last reference to the \"physical\" device may b", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93251", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93270", "title": "bpf: Disallow interpreter fallback for BPF_ADDR_PERCPU insn", "description": "The BPF_MOV64_PERCPU_REG insn requires JIT to emit native code to for 'dst_reg = src_reg + '.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93270", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-93272", "title": "remoteproc: qcom_wcnss: Fix handling the lack of PD regulators in v3", "description": "The changes introduced to handle single power domain platforms have swapped the info pointer increment from num_pd_vregs to num_pds, which would shift the info pointer past the end of the array for pronto-v3, which does not list power domain regulators in vregs.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-93272", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97526", "title": "s390/pai: Support CPU hotplug for PMU PAI", "description": "The command 'perf stat -e pai_crypto/CRYPTO_ALL/ -- ' crashes the kernel when CPUs are hotplug added during that run.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97526", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97532", "title": "scsi: qla2xxx: Null out freed pointers in qla2x00_mem_alloc() error path", "description": "When qla2x00_mem_alloc() fails, qla2x00_probe_one() jumps to probe_hw_failed and calls qla2x00_mem_free(). Several error labels in qla2x00_mem_alloc() freed adapter members (elsrej.c, purex_dma_pool, flt, sfp_data, loop_id_map, async_pd, sf_init_cb, ex_init_cb, npiv_info) but left the pointers dangling. qla2x00_mem_free() then freed them a second time. Worse, for the dma_pool members it issued dma", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97532", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97537", "title": "scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking", "description": "qla25xx_free_req_que() and qla25xx_free_rsp_que() have two pre-existing bugs exposed on the error path of qla25xx_create_{req,rsp}_que():", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97537", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97538", "title": "hwmon: (asus_rog_ryujin) Validate HID report lengths", "description": "rog_ryujin_raw_event() parses response headers and payload fields without first checking that they are present in the received report. A short report can therefore make the driver consume uninitialized bytes from the HID transport buffer and expose them as sensor values through sysfs.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97538", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97539", "title": "usb: xusbatm: don't rely on id table pointer arithmetic", "description": "The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. xusbatm initialize the USB device IDs dynamically so it can just use driver_info too.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97539", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97540", "title": "net: usb: pegasus: don't rely on id table pointer arithmetic", "description": "The current code is broken when dynamic ID is involved; in such cases usb_device_id parameter of probe lives on the heap and the pointer arithmetic will get an index that is wildly out of bound. Instead of keeping a side table for additional information, use driver_info field of the usb_device_id.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97540", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97541", "title": "wifi: ath9k_htc: don't store usb_device_id", "description": "usb_device_id is not guaranteed to live longer than probe due to presence of dynamic ID. All information apart from driver_data can be easily retrieved from usb_device, so just store driver_data.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97541", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97554", "title": "smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()", "description": "cifs_posix_to_fattr() ignores the return value of posix_info_parse(). When a malformed POSIX directory entry is encountered (e.g. invalid SID lengths from an untrusted server), posix_info_parse() returns -1 without populating the 'parsed' struct. The uninitialized stack memory in parsed.owner and parsed.group is then passed to sid_to_id(), which processes the garbage bytes and passes them to reque", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97554", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97561", "title": "smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid", "description": "When the administrator mounts with forceuid or forcegid (uid=/gid= mount options), they expect all files to appear owned by the specified user/group. However, several code paths unconditionally called sid_to_id() to overwrite cf_uid/cf_gid with server-provided values, ignoring the administrator's explicit override:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97561", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97563", "title": "smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()", "description": "The SMB1 synchronous read helper CIFSSMBRead() validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy source is formed as", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97563", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97928", "title": "drm/amdgpu: skip the VMID 0 flush for VRAM", "description": "Clear-on-release only runs on VRAM, which amdgpu_ttm_map_buffer() reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 (e.g. Navi33) that spurious SDMA flush can wedge the engine; only flush when a GART window is actually used.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97928", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97933", "title": "tracing: Take trace_array reference when opening a tracer options file", "description": "When a tracer option file is opened, it is passed a descriptor that points to an element on the trace_array's topts array. This element has information to find the trace array and other information. It uses this element to take a reference of the trace_array so that the trace_array does not get removed while this file is opened.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97933", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97951", "title": "scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands", "description": "When a LUN_RESET aborts a WRITE command that is in the TRANSPORT_WRITE_PENDING state, the target core sets CMD_T_ABORTED and waits for the frontend to finish processing.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97951", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97988", "title": "vhost: invalidate vring access on IOTLB transitions", "description": "When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale ring mappings in use.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97988", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97989", "title": "vduse: validate virtqueue alignment", "description": "vduse_validate_config() only checks the upper bound of vq_align. Invalid values can therefore reach vring_create_virtqueue_map(). The split-ring helpers use align - 1 as a bit mask, so the alignment must be a non-zero power of two. A zero value makes vring_size() drop the descriptor and available-ring part and vring_init() leave the used ring pointer NULL.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97989", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-97997", "title": "virtio_ring: fix stale descriptor flags after a failed packed add", "description": "In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every round of the ring, tracked by a wrap counter, so invalidating or validating a descriptor means inverting both bits.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-97997", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98004", "title": "iommu/riscv: Serialize command queue publishing", "description": "Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the queue lock when the command queue is full so other CPUs are not blocked behind a long poll.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98004", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98019", "title": "bpf: mark a NULL call argument precise", "description": "check_func_arg() allows bpf_register_is_null() for nullable arguments w/o marking the underlying scalar register precise. Hence a checkpoint created on such a path would prune against arbitrary scalar value.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98019", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98032", "title": "tracing: Fix subbuf resize races with trace_pipe_raw readers", "description": "Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98032", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98033", "title": "bpf: Preserve inner map identity in callback frames", "description": "Callback frame constructors initialize map-typed argument registers with __mark_reg_known_zero() and then restore map_ptr. This clears map_uid, which is the only field distinguishing inner maps that share an inner_map_meta template.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98033", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98034", "title": "bpf: Mark NULL kptr stores precise", "description": "check_map_kptr_access() permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it does not mark that register precise.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98034", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98038", "title": "bpf: Keep refcount_acquire nullable for borrowed RCU kptrs", "description": "bpf_refcount_acquire() is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KF_RET_NULL on the return value unless the argument is an owning reference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98038", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98043", "title": "bpf: Don't infer non-NULL from a pointer with an unbounded offset", "description": "reg_not_null() decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL base, in case of an unbound offset the runtime offset value might still add up to NULL. Consider the followng program:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98043", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98048", "title": "bpf: don't rewrite bpf_fastcall patterns entered by a jump", "description": "mark_fastcall_pattern_for_call() must ensure that matched \"spill; call; fill\" instruction series is not interrupted by a jump. Otherwise the rewrite applied by bpf_remove_fastcall_spills_fills() is not sound.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98048", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98049", "title": "bpf: zero extend the result of an arena 32-bit cmpxchg", "description": "bpf_convert_ctx_accesses() rewrites an atomic on an arena pointer from BPF_STX | BPF_ATOMIC to BPF_STX | BPF_PROBE_ATOMIC, and it runs before bpf_opt_subreg_zext_lo32_rnd_hi32().", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98049", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98057", "title": "ring-buffer: Add checking nr_subbufs to persistent ring buffer validation", "description": "Sashiko reported that the code was using meta->nr_subbufs without making sure that it matched the nr_pages + 1 on data that was assuming the two were the same.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98057", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98058", "title": "bpf: Mark syscall helpers as sleepable", "description": "bpf_sys_bpf() executes the bpf(2) syscall body, which can take mutexes, allocate with GFP_KERNEL, and wait for an RCU grace period. bpf_sys_close() reaches close_fd() and filp_close(), which can sleep as well.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98058", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98084", "title": "bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks", "description": "When processing calls to bpf_loop() verifier marks R1 (and R4) as precise. R1 tracks loop iterations number and because of the 'callback_depth < R1' mechanics in check_helper_call() must be marked precise. However, precision propagation for R1 was broken, when bpf_loop() call was verified on a second iteration.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98084", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98085", "title": "bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge", "description": "Nicholas Carlini reported a bug in precision backtracking mechanism for BPF_LD | BPF_{IND,ABS} instructions. These instructions are modelled as two branches: - fallthrough; - implicit exit from current subprogram.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98085", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98099", "title": "ipv6: mcast: use rcu_assign_pointer() for __rcu list updates", "description": "Several places in net/ipv6/mcast.c update RCU-protected lists (np->ipv6_mc_list, idev->mc_list, idev->mc_tomb) using direct pointer assignments instead of rcu_assign_pointer():", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98099", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98106", "title": "drm/pagemap: Prevent double migration of device pages", "description": "A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98106", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98118", "title": "netfs: Fix readahead synchronisation issues by loading all folios upfront", "description": "There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at them or trying to clear them, such as determining the setting of front_folio_order when the next folio hasn't been added yet,", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98118", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98124", "title": "smb/client: invalidate fscache for fallocate range operations", "description": "smb3_zero_range(), smb3_punch_hole(), smb3_insert_range(), and smb3_collapse_range() modify file contents through server-side range operations. These operations discard the affected page cache, but leave the FS-Cache cookie valid, so a later read may return data cached before the range operation.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98124", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98125", "title": "smb/client: fix stale page cache in insert/collapse range", "description": "smb3_insert_range() and smb3_collapse_range() use truncate_pagecache_range() to invalidate the affected page cache. However, if off or old_eof is not page-aligned, the boundary pages are only partially zeroed and remain uptodate. As a result, the client may return stale data after a successful insert/collapse range operation.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98125", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98131", "title": "net: stmmac: fix dma mapping leak in stmmac_tso_xmit()", "description": "In stmmac_tso_xmit(), if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before the failure are never unmapped, leaking DMA mappings.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98131", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98134", "title": "bpf: check_cond_jmp_op(): properly infer if register is null", "description": "Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o PTR_MAYBE_NULL flag, but which allows a value to be NULL at runtime. Here is an example:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98134", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98147", "title": "printk: Don't WARN on kthread_run failure.", "description": "Since __kthread_create_on_node() returns -EINTR upon SIGKILL, we should not use WARN_ON() in order to catch kthread_run() failure.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98147", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98153", "title": "nvme: fix racy access to FDP placement id array", "description": "nvme_query_fdp_info() is called per-path and therefore prone to races.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98153", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98161", "title": "nvdimm: pmem: keep PREFLUSH before data writes", "description": "pmem_submit_bio() records a REQ_PREFLUSH error, but continues to copy the bio data and can later overwrite the error with a successful REQ_FUA flush. That lets data writes run after a failed preflush and can complete the bio successfully despite the failed ordering barrier.", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98161", "fixed_mainline": "7.3", "cvss": null, "severity": "" }, { "id": "CVE-2026-98162", "title": "smb/server: fix tree connection leak in smb2_tree_connect()", "description": "See the procedure below:", "published": "", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98162", "fixed_mainline": "7.3", "cvss": null, "severity": "" } ], "update_to": "" } ] }