Linux Kernel vulnerabilities

CVE-2026-43366 [HIGH] CVE-2026-43366: In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target In the Linux kernel, the following vulnerability has been resolved: io_uring/kbuf: check if target buffer list is still legacy on recycle There's a gap between when the buffer was grabbed and when it potentially gets recycled, where if the list is empty, someone could've upgraded it to a ring provided type. This can happen if the request is forced via io-wq.

CVE-2026-53024 [HIGH] CWE-416 CVE-2026-53024: In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free if write is called after disconnect If a user writes to the chardev after disconnect has been called, the kernel panics with the following trace (with CONFIG_INIT_ON_FREE_DEFAULT_ON=y): BUG: kernel NULL pointer dereference, address: 0000000000000218

CVE-2026-53000 [HIGH] CWE-763 CVE-2026-53000: In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu t In the Linux kernel, the following vulnerability has been resolved: netfilter: nat: use kfree_rcu to release ops Florian Westphal says: "Historically this is not an issue, even for normal base hooks: the data path doesn't use the original nf_hook_ops that are used to register the callbacks. However, in v5.14 I added the ability to dump the active n

CVE-2026-52923 [HIGH] CWE-401 CVE-2026-52923: In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation t In the Linux kernel, the following vulnerability has been resolved: ipc: limit next_id allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids->next_id. ipc_idr_alloc() currently forwards that request to idr_alloc() with an open-ended upper bound. If the valid tail of the SysV IPC id space is

CVE-2026-53025 [HIGH] CWE-416 CVE-2026-53025: In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-fre In the Linux kernel, the following vulnerability has been resolved: greybus: raw: fix use-after-free on cdev close This addresses a use-after-free bug when a raw bundle is disconnected but its chardev is still opened by an application. When the application releases the cdev, it causes the following panic when init on free is enabled (CONFIG_INIT_ON_F

CVE-2026-46234 [HIGH] CWE-787 CVE-2026-46234: In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping In the Linux kernel, the following vulnerability has been resolved: vsock: fix buffer size clamping order In vsock_update_buffer_size(), the buffer size was being clamped to the maximum first, and then to the minimum. If a user sets a minimum buffer size larger than the maximum, the minimum check overrides the maximum check, inverting the constraint.

CVE-2026-46122 [HIGH] CWE-129 CVE-2026-46122: In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check In the Linux kernel, the following vulnerability has been resolved: wifi: b43: enforce bounds check on firmware key index in b43_rx() The firmware-controlled key index in b43_rx() can exceed the dev->key[] array size (58 entries). The existing B43_WARN_ON is non-enforcing in production builds, allowing an out-of-bounds read. Make the B43_WARN_ON che

CVE-2026-46015 [HIGH] CVE-2026-46015: In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after In the Linux kernel, the following vulnerability has been resolved: tcp: call sk_data_ready() after listener migration When inet_csk_listen_stop() migrates an established child socket from a closing listener to another socket in the same SO_REUSEPORT group, the target listener gets a new accept-queue entry via inet_csk_reqsk_queue_add(), but that path never

CVE-2026-46084 [HIGH] CWE-416 CVE-2026-46084: In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: Disable RX steeri In the Linux kernel, the following vulnerability has been resolved: RDMA/mana_ib: Disable RX steering on RSS QP destroy When an RSS QP is destroyed (e.g. DPDK exit), mana_ib_destroy_qp_rss() destroys the RX WQ objects but does not disable vPort RX steering in firmware. This leaves stale steering configuration that still points to the destroyed RX obj

CVE-2026-43330 [HIGH] CWE-787 CVE-2026-43330: In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on In the Linux kernel, the following vulnerability has been resolved: crypto: caam - fix overflow on long hmac keys When a key longer than block size is supplied, it is copied and then hashed into the real key. The memory allocated for the copy needs to be rounded to DMA cache alignment, as otherwise the hashed key may corrupt neighbouring memory. The

CVE-2026-43408 [HIGH] CWE-476 CVE-2026-43408: In the Linux kernel, the following vulnerability has been resolved: ceph: add a bunch of missing ce In the Linux kernel, the following vulnerability has been resolved: ceph: add a bunch of missing ceph_path_info initializers ceph_mdsc_build_path() must be called with a zero-initialized ceph_path_info parameter, or else the following ceph_mdsc_free_path_info() may crash. Example crash (on Linux 6.18.12): virt_to_cache: Object is not a Slab page! W

CVE-2026-31748 [HIGH] CWE-787 CVE-2026-31748: In the Linux kernel, the following vulnerability has been resolved: comedi: me_daq: Fix potential o In the Linux kernel, the following vulnerability has been resolved: comedi: me_daq: Fix potential overrun of firmware buffer `me2600_xilinx_download()` loads the firmware that was requested by `request_firmware()`. It is possible for it to overrun the source buffer because it blindly trusts the file format. It reads a data stream length from the firs

CVE-2026-31768 [HIGH] CVE-2026-31768: In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-adc161s626: use DM In the Linux kernel, the following vulnerability has been resolved: iio: adc: ti-adc161s626: use DMA-safe memory for spi_read() Add a DMA-safe buffer and use it for spi_read() instead of a stack memory. All SPI buffers must be DMA-safe. Since we only need up to 3 bytes, we just use a u8[] instead of __be16 and __be32 and change the conversion functions appr

CVE-2026-31696 [HIGH] CWE-787 CVE-2026-31696: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation o In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpc_preparse(), there are two paths for parsing key payloads: the XDR path (for large payloads) and the non-XDR path (for payloads <= 28 bytes). While the XDR path (rxrpc_preparse_xdr_rxkad()) correctly val

CVE-2026-31505 [HIGH] CWE-787 CVE-2026-31505: In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes In the Linux kernel, the following vulnerability has been resolved: iavf: fix out-of-bounds writes in iavf_get_ethtool_stats() iavf incorrectly uses real_num_tx_queues for ETH_SS_STATS. Since the value could change in runtime, we should use num_tx_queues instead. Moreover iavf_get_ethtool_stats() uses num_active_queues while iavf_get_sset_count() and

CVE-2026-23447 [HIGH] CWE-129 CVE-2026-23447: In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffse In the Linux kernel, the following vulnerability has been resolved: net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check The same bounds-check bug fixed for NDP16 in the previous patch also exists in cdc_ncm_rx_verify_ndp32(). The DPE array size is validated against the total skb length without accounting for ndpoffset, allowing out-of-boun

CVE-2026-23466 [HIGH] CVE-2026-23466: In the Linux kernel, the following vulnerability has been resolved: drm/xe: Open-code GGTT MMIO acc In the Linux kernel, the following vulnerability has been resolved: drm/xe: Open-code GGTT MMIO access protection GGTT MMIO access is currently protected by hotplug (drm_dev_enter), which works correctly when the driver loads successfully and is later unbound or unloaded. However, if driver load fails, this protection is insufficient because drm_dev_unplug()

CVE-2026-23343 [HIGH] CWE-787 CVE-2026-23343: In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when cal In the Linux kernel, the following vulnerability has been resolved: xdp: produce a warning when calculated tailroom is negative Many ethernet drivers report xdp Rx queue frag size as being the same as DMA write size. However, the only user of this field, namely bpf_xdp_frags_increase_tail(), clearly expects a truesize. Such difference leads to unspe

CVE-2026-31576 [HIGH] CWE-416 CVE-2026-31576: In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free In the Linux kernel, the following vulnerability has been resolved: media: hackrf: fix to not free memory after the device is registered in hackrf_probe() In hackrf driver, the following race condition occurs: ``` CPU0 CPU1 hackrf_probe() kzalloc(); // alloc hackrf_dev .... v4l2_device_register(); .... fd = sys_open("/path/to/dev"); // open hackrf fd

CVE-2022-50518 [HIGH] CWE-667 CVE-2022-50518: In the Linux kernel, the following vulnerability has been resolved: parisc: Fix locking in pdc_iodc In the Linux kernel, the following vulnerability has been resolved: parisc: Fix locking in pdc_iodc_print() firmware call Utilize pdc_lock spinlock to protect parallel modifications of the iodc_dbuf[] buffer, check length to prevent buffer overflow of iodc_dbuf[], drop the iodc_retbuf[] buffer and fix some wrong indentings.