Linux Kernel vulnerabilities

CVE-2026-43059 [HIGH] CWE-416 CVE-2026-43059: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corru In the Linux kernel, the following vulnerability has been resolved: Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") introduced mgmt_pending_valid(), which not only validates the pending command but also unlinks it from the pending list if it is valid. This change in

CVE-2026-23221 [HIGH] CWE-416 CVE-2026-23221: In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lo

CVE-2026-53172 [HIGH] CWE-125 CVE-2026-53172: In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region in In the Linux kernel, the following vulnerability has been resolved: accel/ethosu: fix IFM region index out-of-bounds in command stream parser NPU_SET_IFM_REGION extracts the region index with param & 0x7f, giving a maximum value of 127. However region_size[] and output_region[] in struct ethosu_validated_cmdstream_info are both sized to NPU_BASEP_REG

CVE-2026-46263 [HIGH] CWE-125 CVE-2026-46263: In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bou In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix out-of-bounds stream encoder index v3 eng_id can be negative and that stream_enc_regs[] can be indexed out of bounds. eng_id is used directly as an index into stream_enc_regs[], which has only 5 entries. When eng_id is 5 (ENGINE_ID_DIGF) or negative, this can ac

CVE-2026-46260 [HIGH] CWE-125 CVE-2026-46260: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access i In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node(). syzbot reported out-of-bound read in fib6_add_rt2node(). [0] When IPv6 route is created with RTA_NH_ID, struct fib6_info does not have the trailing struct fib6_nh. The cited commit started to check !iter->fib6_nh->fib_nh_gw_famil

CVE-2025-71082 [HIGH] CVE-2025-71082: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: revert use of devm_kzalloc in btusb This reverts commit 98921dbd00c4e ("Bluetooth: Use devm_kzalloc in btusb.c file"). In btusb_probe(), we use devm_kzalloc() to allocate the btusb data. This ties the lifetime of all the btusb data to the binding of a driver to one interfa

CVE-2025-71091 [HIGH] CVE-2025-71091: In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enable In the Linux kernel, the following vulnerability has been resolved: team: fix check for port enabled in team_queue_override_port_prio_changed() There has been a syzkaller bug reported recently with the following trace: list_del corruption, ffff888058bea080->prev is LIST_POISON2 (dead000000000122) ------------[ cut here ]------------ kernel BUG at lib/list_d

CVE-2026-53262 [HIGH] CVE-2026-53262: In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference In the Linux kernel, the following vulnerability has been resolved: l2tp: pppol2tp: hold reference to session in pppol2tp_ioctl() pppol2tp_ioctl() read sock->sk->sk_user_data directly without any locks or reference counting. If a controllable sleep was induced during copy_from_user() (e.g. via a userfaultfd page fault sleep), a concurrent socket close could t

CVE-2026-31702 [HIGH] CVE-2026-31702: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix use-after-free of sbi In the Linux kernel, the following vulnerability has been resolved: f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io() In f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring the F2FS_WB_CP_DATA counter to zero, unblocking f2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount CPU. The unmount path then proceeds to cal

CVE-2026-31399 [HIGH] CWE-416 CVE-2026-31399: In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use a In the Linux kernel, the following vulnerability has been resolved: nvdimm/bus: Fix potential use after free in asynchronous initialization Dingisoul with KASAN reports a use after free if device_add() fails in nd_async_device_register(). Commit b6eae0f61db2 ("libnvdimm: Hold reference on parent while scheduling async init") correctly added a refere

CVE-2026-23234 [HIGH] CWE-416 CVE-2026-23234: In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_ In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid UAF in f2fs_write_end_io() As syzbot reported an use-after-free issue in f2fs_write_end_io(). It is caused by below race condition: loop device umount - worker_thread - loop_process_work - do_req_filebacked - lo_rw_aio - lo_rw_aio_complete - blk_mq_end_request -

CVE-2026-53272 [HIGH] CWE-416 CVE-2026-53272: In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sb In the Linux kernel, the following vulnerability has been resolved: erofs: fix use-after-free on sbi->sync_decompress z_erofs_decompress_kickoff() can race with filesystem unmount, causing a use-after-free on sbi->sync_decompress. When I/O completes, z_erofs_endio() calls z_erofs_decompress_kickoff() to queue z_erofs_decompressqueue_work() asynchron

CVE-2026-53112 [HIGH] CWE-416 CVE-2026-53112: In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possibl In the Linux kernel, the following vulnerability has been resolved: wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet The irq_prepare_bcn_tasklet is initialized in rtl_pci_init() and scheduled when RTL_IMR_BCNINT interrupt is triggered by hardware. But it is never killed in rtl_pci_deinit(). When the rtlwifi

CVE-2026-43278 [HIGH] CWE-415 CVE-2026-43278: In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio po In the Linux kernel, the following vulnerability has been resolved: dm: clear cloned request bio pointer when last clone bio completes Stale rq->bio values have been observed to cause double-initialization of cloned bios in request-based device-mapper targets, leading to use-after-free and double-free scenarios. One such case occurs when using dm-mu

CVE-2026-23171 [HIGH] CWE-416 CVE-2026-23171: In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave

CVE-2026-23194 [HIGH] CWE-787 CVE-2026-23194: In the Linux kernel, the following vulnerability has been resolved: rust_binder: correctly handle F In the Linux kernel, the following vulnerability has been resolved: rust_binder: correctly handle FDA objects of length zero Fix a bug where an empty FDA (fd array) object with 0 fds would cause an out-of-bounds error. The previous implementation used `skip == 0` to mean "this is a pointer fixup", but 0 is also the correct skip length for an empty FD

CVE-2026-52991 [HIGH] CWE-362 CVE-2026-52991: In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between fil In the Linux kernel, the following vulnerability has been resolved: sched/psi: fix race between file release and pressure write A potential race condition exists between pressure write and cgroup file release regarding the priv member of struct kernfs_open_file, which triggers the uaf reported in [1]. Consider the following scenario involving execut

CVE-2026-46227 [HIGH] CWE-416 CVE-2026-46227: In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor af In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL The SCTP_SENDALL path in sctp_sendmsg() iterates ep->asocs with list_for_each_entry_safe(), which caches the next entry in @tmp before the loop body runs. The body calls sctp_sendmsg_to_asoc(), which may drop t

CVE-2026-53400 [HIGH] CWE-362 CVE-2026-53400: In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registra In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter() which takes a reference to the embedded struct device. Make sure that the adapter (including its struct device) has been initialised before adding it to the IDR to avoid acce

CVE-2026-53185 [HIGH] CWE-416 CVE-2026-53185: In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zra In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zram_bvec_write_partial() zram_read_page() picks the sync or async backing device read path based on whether the parent bio is NULL. zram_bvec_write_partial() passes its parent bio down, so for ZRAM_WB slots the read is dispatched asynchronously and zram_r