Linux Kernel vulnerabilities

CVE-2026-46209 [HIGH] CWE-787 CVE-2026-46209: In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane In the Linux kernel, the following vulnerability has been resolved: drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() drm_gem_fb_init_with_funcs() computes sub-sampled plane dimensions using plain integer division: unsigned int width = mode_cmd->width / (i ? info->hsub : 1); unsigned int height = mode_cmd->height

CVE-2023-53556 [HIGH] CWE-416 CVE-2023-53556: In the Linux kernel, the following vulnerability has been resolved: iavf: Fix use-after-free in fre In the Linux kernel, the following vulnerability has been resolved: iavf: Fix use-after-free in free_netdev We do netif_napi_add() for all allocated q_vectors[], but potentially do netif_napi_del() for part of them, then kfree q_vectors and leave invalid pointers at dev->napi_list. Reproducer: [root@host ~]# cat repro.sh #!/bin/bash pf_dbsf="0000:

CVE-2026-43260 [HIGH] CWE-415 CVE-2026-43260: In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix RSS context delete logic We need to free the corresponding RSS context VNIC in FW everytime an RSS context is deleted in driver. Commit 667ac333dbb7 added a check to delete the VNIC in FW only when netif_running() is true to help delete RSS contexts with interface down.

CVE-2025-39711 [HIGH] CWE-416 CVE-2025-39711: In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutd In the Linux kernel, the following vulnerability has been resolved: media: ivsc: Fix crash at shutdown due to missing mei_cldev_disable() calls Both the ACE and CSI driver are missing a mei_cldev_disable() call in their remove() function. This causes the mei_cl client to stay part of the mei_device->file_list list even though its memory is freed by

CVE-2026-63804 [HIGH] CWE-416 CVE-2026-63804: In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU call

CVE-2026-53033 [HIGH] CWE-825 CVE-2026-53033: In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock f In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Take state lock for af_unix iter When a BPF iterator program updates a sockmap, there is a race condition in unix_stream_bpf_update_proto() where the `peer` pointer can become stale[1] during a state transition TCP_ESTABLISHED -> TCP_CLOSE. CPU0 bpf CPU1 close --------

CVE-2026-31494 [HIGH] CWE-787 CVE-2026-31494: In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queu In the Linux kernel, the following vulnerability has been resolved: net: macb: use the current queue number for stats There's a potential mismatch between the memory reserved for statistics and the amount of memory written. gem_get_sset_count() correctly computes the number of stats based on the active queues, whereas gem_get_ethtool_stats() indiscr

CVE-2026-43138 [HIGH] CWE-416 CVE-2026-43138: In the Linux kernel, the following vulnerability has been resolved: reset: gpio: suppress bind attr In the Linux kernel, the following vulnerability has been resolved: reset: gpio: suppress bind attributes in sysfs This is a special device that's created dynamically and is supposed to stay in memory forever. We also currently don't have a devlink between it and the actual reset consumer. Suppress sysfs bind attributes so that user-space can't unbin

CVE-2026-43009 [HIGH] CVE-2026-43009: In the Linux kernel, the following vulnerability has been resolved: bpf: Fix incorrect pruning due In the Linux kernel, the following vulnerability has been resolved: bpf: Fix incorrect pruning due to atomic fetch precision tracking When backtrack_insn encounters a BPF_STX instruction with BPF_ATOMIC and BPF_FETCH, the src register (or r0 for BPF_CMPXCHG) also acts as a destination, thus receiving the old value from the memory location. The current backtr

CVE-2026-23323 [HIGH] CWE-787 CVE-2026-23323: In the Linux kernel, the following vulnerability has been resolved: hwmon: (macsmc) Fix regressions In the Linux kernel, the following vulnerability has been resolved: hwmon: (macsmc) Fix regressions in Apple Silicon SMC hwmon driver The recently added macsmc-hwmon driver contained several critical bugs in its sensor population logic and float conversion routines. Specifically: - The voltage sensor population loop used the wrong prefix ("volt-" in

CVE-2026-23074 [HIGH] CWE-416 CVE-2026-23074: In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql ca In the Linux kernel, the following vulnerability has been resolved: net/sched: Enforce that teql can only be used as root qdisc Design intent of teql is that it is only supposed to be used as root qdisc. We need to check for that constraint. Although not important, I will describe the scenario that unearthed this issue for the curious. GangMin Kim

CVE-2025-39939 [HIGH] CWE-787 CVE-2025-39939: In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix memory corrupti In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix memory corruption when using identity domain zpci_get_iommu_ctrs() returns counter information to be reported as part of device statistics; these counters are stored as part of the s390_domain. The problem, however, is that the identity domain is not backed by an s390

CVE-2026-63803 [HIGH] CWE-416 CVE-2026-63803: In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers In the Linux kernel, the following vulnerability has been resolved: hdlc_ppp: sync per-proto timers before freeing hdlc state Each PPP control protocol (LCP/IPCP/IPV6CP) embedded in struct ppp registers a timer via timer_setup(). That struct ppp is the hdlc->state allocation, which detach_hdlc_protocol() frees with kfree() in both teardown paths: unr

CVE-2026-45839 [HIGH] CWE-129 CVE-2026-45839: In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE acce In the Linux kernel, the following vulnerability has been resolved: bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() CO-RE accessor strings are colon-separated indices that describe a path from a root BTF type to a target field, e.g. "0:1:2" walks through nested struct members. bpf_core_parse_spec() parses each component with ssca

CVE-2025-39935 [HIGH] CWE-787 CVE-2025-39935: In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memor In the Linux kernel, the following vulnerability has been resolved: ASoC: codec: sma1307: Fix memory corruption in sma1307_setting_loaded() The sma1307->set.header_size is how many integers are in the header (there are 8 of them) but instead of allocating space of 8 integers we allocate 8 bytes. This leads to memory corruption when we copy data it on

CVE-2025-39868 [HIGH] CVE-2025-39868: In the Linux kernel, the following vulnerability has been resolved: erofs: fix runtime warning on t In the Linux kernel, the following vulnerability has been resolved: erofs: fix runtime warning on truncate_folio_batch_exceptionals() Commit 0e2f80afcfa6("fs/dax: ensure all pages are idle prior to filesystem unmount") introduced the WARN_ON_ONCE to capture whether the filesystem has removed all DAX entries or not and applied the fix to xfs and ext4. Apply

CVE-2026-23372 [HIGH] CVE-2026-23372: In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work be In the Linux kernel, the following vulnerability has been resolved: nfc: rawsock: cancel tx_work before socket teardown In rawsock_release(), cancel any pending tx_work and purge the write queue before orphaning the socket. rawsock_tx_work runs on the system workqueue and calls nfc_data_exchange which dereferences the NCI device. Without synchronization, tx_

CVE-2026-31769 [HIGH] CWE-416 CVE-2026-31769: In the Linux kernel, the following vulnerability has been resolved: gpib: fix use-after-free in IO In the Linux kernel, the following vulnerability has been resolved: gpib: fix use-after-free in IO ioctl handlers The IBRD, IBWRT, IBCMD, and IBWAIT ioctl handlers use a gpib_descriptor pointer after board->big_gpib_mutex has been released. A concurrent IBCLOSEDEV ioctl can free the descriptor via close_dev_ioctl() during this window, causing a use-af

CVE-2026-23415 [HIGH] CWE-416 CVE-2026-23415: In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_ke In the Linux kernel, the following vulnerability has been resolved: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() During futex_key_to_node_opt() execution, vma->vm_policy is read under speculative mmap lock and RCU. Concurrently, mbind() may call vma_replace_policy() which frees the old mempolicy immediately via kmem_cache_f

CVE-2026-23390 [HIGH] CWE-787 CVE-2026-23390: In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dma_map_sg tra In the Linux kernel, the following vulnerability has been resolved: tracing/dma: Cap dma_map_sg tracepoint arrays to prevent buffer overflow The dma_map_sg tracepoint can trigger a perf buffer overflow when tracing large scatter-gather lists. With devices like virtio-gpu creating large DRM buffers, nents can exceed 1000 entries, resulting in: phys_a