Linux Kernel vulnerabilities

CVE-2026-43250 [HIGH] CWE-787 CVE-2026-43250: In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and In the Linux kernel, the following vulnerability has been resolved: usb: chipidea: udc: fix DMA and SG cleanup in _ep_nuke() The ChipIdea UDC driver can encounter "not page aligned sg buffer" errors when a USB device is reconnected after being disconnected during an active transfer. This occurs because _ep_nuke() returns requests to the gadget layer

CVE-2026-31586 [HIGH] CWE-416 CVE-2026-31586: In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkc

CVE-2026-53161 [HIGH] CWE-416 CVE-2026-53161: In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-fr In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpc_user in workqueue context There is a race between fastrpc_device_release() and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpc_device_release() frees the fastrpc_user structure. Concurrently, a

CVE-2026-46173 [HIGH] CWE-787 CVE-2026-46173: In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oop In the Linux kernel, the following vulnerability has been resolved: exit: prevent preemption of oopsing TASK_DEAD task When an already-exiting task oopses, make_task_dead() currently calls do_task_dead() with preemption enabled. That is forbidden: do_task_dead() calls __schedule(), which has a comment saying "WARNING: must be called with preemption d

CVE-2026-43075 [HIGH] CWE-787 CVE-2026-43075: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free write of 4086 bytes in ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on a loop device. The actual bug i

CVE-2026-63799 [HIGH] CWE-125 CVE-2026-63799: In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clear_bit In the Linux kernel, the following vulnerability has been resolved: sched/mmcid: Fix OOB clear_bit when CID is MM_CID_UNSET in fixup path In mm_cid_fixup_cpus_to_tasks(), when rq->curr has the target mm and mm_cid.active is set, the CID is checked with cid_in_transit() before setting the transition bit. In per-CPU mode a newly forked or exec'd task ca

CVE-2026-23208 [HIGH] CWE-787 CVE-2026-23208: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Prevent excess In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Prevent excessive number of frames In this case, the user constructed the parameters with maxpacksize 40 for rate 22050 / pps 1000, and packsize[0] 22 packsize[1] 23. The buffer size for each data URB is maxpacksize * packets, which in this example is 40 * 6 = 240; W

CVE-2026-53173 [HIGH] CWE-787 CVE-2026-53173: In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix OOB write in ethosu_gem_cmdstream_copy_and_validate() The command stream parsing loop increments the index variable a second time when a 64-bit command word is encountered (bit 14 set), but does not re-check the loop bound before writing the second word: for (i = 0;

CVE-2026-52927 [HIGH] CWE-125 CVE-2026-52927: In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB re In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: fix OOB read in compat_mtw_from_user Luxiao Xu says: The function compat_mtw_from_user() converts ebtables extensions from 32-bit user structures to kernel native structures. However, it lacks proper validation of the user-supplied match_size/target_size. When

CVE-2026-23288 [HIGH] CWE-125 CVE-2026-23288: In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bound In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix out-of-bounds memset in command slot handling The remaining space in a command slot may be smaller than the size of the command header. Clearing the command header with memset() before verifying the available slot space can result in an out-of-bounds write and memo

CVE-2025-71152 [HIGH] CVE-2025-71152: In the Linux kernel, the following vulnerability has been resolved: net: dsa: properly keep track o In the Linux kernel, the following vulnerability has been resolved: net: dsa: properly keep track of conduit reference Problem description DSA has a mumbo-jumbo of reference handling of the conduit net device and its kobject which, sadly, is just wrong and doesn't make sense. There are two distinct problems. 1. The OF path, which uses of_find_net_device_b

CVE-2022-3623 [HIGH] CWE-362 CVE-2022-3623: A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vul A vulnerability was found in Linux Kernel. It has been declared as problematic. Affected by this vulnerability is the function follow_page_pte of the file mm/gup.c of the component BPF. The manipulation leads to race condition. The attack can be launched remotely. It is recommended to apply a patch to fix this issue. The identifier VDB-211921 was assign

CVE-2026-52906 [HIGH] CVE-2026-52906: In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being In the Linux kernel, the following vulnerability has been resolved: 9p: fix access mode flags being ORed instead of replaced Since commit 1f3e4142c0eb ("9p: convert to the new mount API"), v9fs_apply_options() applies parsed mount flags with |= onto flags already set by v9fs_session_init(). For 9P2000.L, session_init sets V9FS_ACCESS_CLIENT as the default, s

CVE-2026-43194 [HIGH] CVE-2026-43194: In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO In the Linux kernel, the following vulnerability has been resolved: net: consume xmit errors of GSO frames udpgro_frglist.sh and udpgro_bench.sh are the flakiest tests currently in NIPA. They fail in the same exact way, TCP GRO test stalls occasionally and the test gets killed after 10min. These tests use veth to simulate GRO. They attach a trivial ("return

CVE-2024-39462 [CRITICAL] CWE-400 CVE-2024-39462: In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num bef In the Linux kernel, the following vulnerability has been resolved: clk: bcm: dvp: Assign ->num before accessing ->hws Commit f316cdff8d67 ("clk: Annotate struct clk_hw_onecell_data with __counted_by") annotated the hws member of 'struct clk_hw_onecell_data' with __counted_by, which informs the bounds sanitizer about the number of elements in hws

CVE-2026-53199 [HIGH] CVE-2026-53199: In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct

CVE-2026-46027 [HIGH] CVE-2026-46027: In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access in smc_clc_wait_msg A CLC decline can be received while the handshake is still in an early stage, before the connection has been associated with a link group. The decline handling in smc_clc_wait_msg() updates link-group level sync state for first-contact dec

CVE-2026-46110 [HIGH] CWE-476 CVE-2026-46110: In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref In the Linux kernel, the following vulnerability has been resolved: net: stmmac: Prevent NULL deref when RX memory exhausted The CPU receives frames from the MAC through conventional DMA: the CPU allocates buffers for the MAC, then the MAC fills them and returns ownership to the CPU. For each hardware RX queue, the CPU and MAC coordinate through a sh

CVE-2026-52946 [HIGH] CWE-667 CVE-2026-52946: In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lo In the Linux kernel, the following vulnerability has been resolved: fs/fcntl: fix SOFTIRQ-unsafe lock order in fasync signaling A SOFTIRQ-safe to SOFTIRQ-unsafe lock order deadlock can occur in send_sigio() and send_sigurg() when a process group receives a signal. When FASYNC is configured for a process group (PIDTYPE_PGID), both functions use read_

CVE-2026-43184 [HIGH] CVE-2026-43184: In the Linux kernel, the following vulnerability has been resolved: rnbd-srv: Zero the rsp buffer b In the Linux kernel, the following vulnerability has been resolved: rnbd-srv: Zero the rsp buffer before using it Before using the data buffer to send back the response message, zero it completely. This prevents any stray bytes to be picked up by the client side when there the message is exchanged between different protocol versions.