Linux Kernel vulnerabilities

CVE-2026-43093 [HIGH] CVE-2026-43093: In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom vali In the Linux kernel, the following vulnerability has been resolved: xsk: tighten UMEM headroom validation to account for tailroom and min frame The current headroom validation in xdp_umem_reg() could leave us with insufficient space dedicated to even receive minimum-sized ethernet frame. Furthermore if multi-buffer would come to play then skb_shared_info sto

CVE-2026-43256 [HIGH] CWE-125 CVE-2026-43256: In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: vfe: Fix ou In the Linux kernel, the following vulnerability has been resolved: media: qcom: camss: vfe: Fix out-of-bounds access in vfe_isr_reg_update() vfe_isr() iterates using MSM_VFE_IMAGE_MASTERS_NUM(7) as the loop bound and passes the index to vfe_isr_reg_update(). However, vfe->line[] array is defined with VFE_LINE_NUM_MAX(4): struct vfe_line line[VFE_LI

CVE-2026-31743 [HIGH] CWE-787 CVE-2026-31743: In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: Fix buffer In the Linux kernel, the following vulnerability has been resolved: nvmem: zynqmp_nvmem: Fix buffer size in DMA and memcpy Buffer size used in dma allocation and memcpy is wrong. It can lead to undersized DMA buffer access and possible memory corruption. use correct buffer size in dma_alloc_coherent and memcpy.

CVE-2026-43007 [HIGH] CWE-415 CVE-2026-43007: In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactiva In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Handle DBC deactivation if the owner went away When a DBC is released, the device sends a QAIC_TRANS_DEACTIVATE_FROM_DEV transaction to the host over the QAIC_CONTROL MHI channel. QAIC handles this by calling decode_deactivate() to release the resources allocated for that

CVE-2026-31693 [HIGH] CWE-908 CVE-2026-31693: In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializati In the Linux kernel, the following vulnerability has been resolved: cifs: some missing initializations on replay In several places in the code, we have a label to signify the start of the code where a request can be replayed if necessary. However, some of these places were missing the necessary reinitializations of certain local variables before repl

CVE-2026-23361 [HIGH] CWE-787 CVE-2026-23361: In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may retur

CVE-2026-23383 [HIGH] CVE-2026-23383: In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Force 8-byte alignm In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing struct bpf_plt contains a u64 target field. Currently, the BPF JIT allocator requests an alignment of 4 bytes (sizeof(u32)) for the JIT buffer. Because the base address of the JIT buffer can be 4-byte aligned (e.g.,

CVE-2026-23354 [HIGH] CWE-129 CVE-2026-23354: In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative s In the Linux kernel, the following vulnerability has been resolved: x86/fred: Correct speculative safety in fred_extint() array_index_nospec() is no use if the result gets spilled to the stack, as it makes the believed safe-under-speculation value subject to memory predictions. For all practical purposes, this means array_index_nospec() must be used

CVE-2026-43434 [HIGH] CVE-2026-43434: In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership be In the Linux kernel, the following vulnerability has been resolved: rust_binder: check ownership before using vma When installing missing pages (or zapping them), Rust Binder will look up the vma in the mm by address, and then call vm_insert_page (or zap_page_range_single). However, if the vma is closed and replaced with a different vma at the same address,

CVE-2026-53157 [HIGH] CWE-416 CVE-2026-53157: In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device In the Linux kernel, the following vulnerability has been resolved: net: phonet: free phonet_device after RCU grace period phonet_device_destroy() removes a phonet_device from the per-net device list with list_del_rcu(), but frees it immediately. RCU readers walking the same list can still hold a pointer to the object after it has been removed, leadi

CVE-2026-46120 [HIGH] CWE-416 CVE-2026-46120: In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in i In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and stil

CVE-2026-45914 [HIGH] CWE-416 CVE-2026-45914: In the Linux kernel, the following vulnerability has been resolved: Revert "hwmon: (ibmpex) fix use In the Linux kernel, the following vulnerability has been resolved: Revert "hwmon: (ibmpex) fix use-after-free in high/low store" This reverts commit 6946c726c3f4c36f0f049e6f97e88c510b15f65d. Jean Delvare points out that the patch does not completely fix the reported problem, that it in fact introduces a (new) race condition, and that it may actuall

CVE-2026-43426 [HIGH] CWE-416 CVE-2026-43426: In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: fix use-aft In the Linux kernel, the following vulnerability has been resolved: usb: renesas_usbhs: fix use-after-free in ISR during device removal In usbhs_remove(), the driver frees resources (including the pipe array) while the interrupt handler (usbhs_interrupt) is still registered. If an interrupt fires after usbhs_pipe_remove() but before the driver is ful

CVE-2026-31675 [HIGH] CWE-125 CVE-2026-31675: In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-o In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_netem: fix out-of-bounds access in packet corruption In netem_enqueue(), the packet corruption logic uses get_random_u32_below(skb_headlen(skb)) to select an index for modifying skb->data. When an AF_PACKET TX_RING sends fully non-linear packets over an IPIP tunnel, sk

CVE-2026-31473 [HIGH] CWE-416 CVE-2026-31473: In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REIN In the Linux kernel, the following vulnerability has been resolved: media: mc, v4l2: serialize REINIT and REQBUFS with req_queue_mutex MEDIA_REQUEST_IOC_REINIT can run concurrently with VIDIOC_REQBUFS(0) queue teardown paths. This can race request object cleanup against vb2 queue cancellation and lead to use-after-free reports. We already serialize

CVE-2026-23281 [HIGH] CWE-416 CVE-2026-23281: In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: fix use-after-free in lbs_free_adapter() The lbs_free_adapter() function uses timer_delete() (non-synchronous) for both command_timer and tx_lockup_timer before the structure is freed. This is incorrect because timer_delete() does not wait for any running timer callba

CVE-2026-46121 [HIGH] CWE-416 CVE-2026-46121: In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect In the Linux kernel, the following vulnerability has been resolved: mm/damon/sysfs-schemes: protect memcg_path kfree() with damon_sysfs_lock Patch series "mm/damon/sysfs-schemes: fix use-after-free for [memcg_]path". Reads of 'memcg_path' and 'path' files in DAMON sysfs interface could race with their writes, results in use-after-free. Fix those.

CVE-2026-31530 [HIGH] CWE-416 CVE-2026-31530: In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of In the Linux kernel, the following vulnerability has been resolved: cxl/port: Fix use after free of parent_port in cxl_detach_ep() cxl_detach_ep() is called during bottom-up removal when all CXL memory devices beneath a switch port have been removed. For each port in the hierarchy it locks both the port and its parent, removes the endpoint, and if th

CVE-2025-71071 [HIGH] CWE-416 CVE-2025-71071: In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-f In the Linux kernel, the following vulnerability has been resolved: iommu/mediatek: fix use-after-free on probe deferral The driver is dropping the references taken to the larb devices during probe after successful lookup as well as on errors. This can potentially lead to a use-after-free in case a larb device has not yet been bound to its driver so

CVE-2026-43279 [HIGH] CWE-787 CVE-2026-43279: In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity che In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Add sanity check for OOB writes at silencing At silencing the playback URB packets in the implicit fb mode before the actual playback, we blindly assume that the received packets fit with the buffer size. But when the setup in the capture stream differs from the play