By vendor

Linux vulnerabilities

Known CVEs affecting Linux products, prioritized by severity, with SEC.co remediation and detection guidance.

1178 published vulnerabilities · page 10 of 12

• CVE-2026-53017MEDIUM 5.5

  A data loss vulnerability exists in the Linux kernel's F2FS file system implementation. The issue occurs when a newly created file is synchronized to disk (fsync) at the exact moment a checkpoint operation is in progress. Due to incorrect flag interpretation, the kernel may fail to write the file's inode block, resulting in permanent data loss. The vulnerability requires local access and specific timing, making it a moderate but serious threat to systems relying on F2FS for storage.

• CVE-2026-53018MEDIUM 5.5

  A bug in the Linux kernel's f2fs (Flash-Friendly File System) implementation can cause a crash when the garbage collector attempts to read a memory page that has already been updated and moved to a new location. During normal file system operations, a page may be relocated from one disk block to another and marked as up-to-date. If the garbage collector then tries to read that same page from its old location without checking its status first, it triggers a kernel panic. The fix prevents unnecessary read operations on pages that have already been refreshed, eliminating the crash condition.

• CVE-2026-53019MEDIUM 5.5

  A logic error in the Linux kernel's SpaceMIT clock control unit (CCU) driver causes the system to skip necessary frequency scaling operations. When the kernel attempts to change CPU frequency—a routine operation during power management—a reversed conditional check prevents the actual frequency change from being triggered, leading to kernel panics. This affects systems running the vulnerable kernel version on SpaceMIT-based hardware.

• CVE-2026-53021MEDIUM 5.5

  A bug in the Linux kernel's SCSI target subsystem fails to properly validate certain storage device commands. Specifically, when processing UNMAP requests (which deallocate storage blocks), the code checks that the operation stays within the device's capacity but misses cases where the arithmetic wraps around a 64-bit boundary. An authenticated local user could exploit this to trigger a denial-of-service condition by crashing the kernel or causing unexpected behavior.

• CVE-2026-53022MEDIUM 5.5

  A buffer overflow vulnerability exists in the Linux kernel's Dell WMI System Management driver. The driver aggregates firmware-provided configuration strings into fixed 512-byte buffers without properly checking whether all strings will fit. An attacker with local system access could craft malicious firmware data that causes the buffer to overflow, potentially crashing the system or enabling privilege escalation. The vulnerability requires local access and low-level privileges to exploit.

• CVE-2026-53023MEDIUM 5.5

  A flaw in the Linux kernel's NTFS3 file system driver can cause the system to read beyond the boundaries of a memory buffer when displaying a volume label. The problem occurs because the code that converts the volume label from UTF-16 to UTF-8 format doesn't properly null-terminate the resulting string. When a volume label exactly fills the available buffer space, the system may access memory locations outside the intended buffer, potentially causing a denial of service. This requires local access to the system and affects systems that mount NTFS volumes using the NTFS3 driver.

• CVE-2026-53027MEDIUM 5.5

  A bug in the Linux kernel's NTFS3 filesystem driver can cause the system to crash or become unstable when handling compressed or sparse file attributes with specific memory alignment characteristics. The issue occurs because the code fails to load necessary metadata for certain file clusters before attempting to allocate new storage space, leading to an unexpected warning condition that can trigger a kernel panic. This affects systems running vulnerable Linux kernels that use NTFS3, particularly those storing compressed or sparse files.

• CVE-2026-53028MEDIUM 5.5

  A coding error in the Linux kernel's USB Type-C driver can cause a system crash when the driver attempts to register a USB Type-C partner device and that registration fails. The code checks whether the registration failed but does not exit early; instead it continues executing and tries to use the failed result as if it were valid, leading to a crash. This affects systems with USB Type-C controllers using the TI TUSB322 driver.

• CVE-2026-53029MEDIUM 5.5

  A logic flaw in the Linux kernel's NTFS3 filesystem handler can cause the system to use an uninitialized memory value during certain file operations. When the kernel attempts to map file regions for input/output, it may fail to properly initialize a critical variable (lcn) under specific conditions, leading to a kernel crash. The issue occurs when handling files or filesystem states that trigger a zero-length condition without setting up required data structures first. An unprivileged local user can trigger this by attempting to read or write to specially crafted NTFS3 filesystem files.

• CVE-2026-53030MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Renesas i3c master driver. When the driver processes i3c transfer operations, it allocates internal data structures that are never properly freed, causing memory to accumulate over time. This can lead to denial of service if an attacker with local access repeatedly triggers the affected code path, eventually exhausting system memory and causing the kernel to become unstable or crash.

• CVE-2026-53032MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's eBPF map handling code. When a scalar register is incorrectly stored into a kernel pointer (kptr) slot, the kernel fails to validate the pointer type before attempting to dereference memory, causing a kernel crash. This is a local privilege issue that requires an attacker with local access and the ability to run eBPF programs.

• CVE-2026-53034MEDIUM 5.5

  A race condition in the Linux kernel's socket map (sockmap) implementation can cause a kernel crash when BPF programs attempt to update socket maps while Unix domain stream sockets are being connected. The vulnerability occurs because the kernel marks a socket as established before fully initializing its peer connection, creating a narrow window where a BPF sockmap update operation may dereference a null pointer. An attacker with local access and permission to load BPF programs could trigger this null-pointer dereference, causing a denial of service. The issue is resolved by adding a null-check in the Unix stream socket protocol update handler to ensure the peer socket is properly initialized before attempting to access it.

• CVE-2026-53035MEDIUM 5.5

  CVE-2026-53035 is a deadlock vulnerability in the Linux kernel's eBPF (Berkeley Packet Filter) subsystem, specifically within the Unix domain socket iterator and socket map components. When a BPF program iterates over Unix sockets and attempts to update a socket map during iteration, the kernel can deadlock because the same lock is acquired twice. This occurs because the iterator holds a fast-path lock on the socket, and the socket map update operation tries to acquire the same lock again, causing the system to hang. The vulnerability requires local access and elevated privileges to trigger.

• CVE-2026-53037MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's USB HID (Human Interface Device) driver reset handling. When a USB device combines HID functionality with storage or UAS (USB Attached SCSI) components, the kernel must reset all components together. The vulnerability occurs because memory allocation during the reset process can trigger block I/O operations, which deadlock against a mutex held during device reset. This causes the system to hang when such hybrid USB devices encounter errors requiring reset.

• CVE-2026-53038MEDIUM 5.5

  A vulnerability in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem can trigger a memory safety bug when the kernel attempts to look up hash algorithm names for TPM banks that the system doesn't recognize. Specifically, when a TPM chip reports support for a hash algorithm (like SHA3-256) that the kernel doesn't yet have in its algorithm table, the code sets an invalid index and later uses that index to access a global array of algorithm names, reading past the array bounds. This causes a kernel crash (denial of service) during system initialization. The issue is particularly relevant as newer TPM specifications include algorithms not yet reflected in all kernel versions.

• CVE-2026-53039MEDIUM 5.5

  A flaw in the Linux kernel's OCFS2 filesystem implementation allows a local user to trigger a kernel panic (denial of service) by providing specially crafted input to the OCFS2_IOC_GROUP_ADD ioctl. The vulnerability stems from the code attempting to cache group descriptor information before properly validating it, causing an assertion failure in the buffer management code.

• CVE-2026-53042MEDIUM 5.5

  A flaw in the Linux kernel's fwctl subsystem can cause the system to crash when removing certain devices. The issue stems from a module initialization ordering problem: the CXL driver loads before fwctl and tries to register devices before fwctl is ready, leaving internal data structures uninitialized. When those devices are later removed, the kernel attempts to clean up the uninitialized structures, triggering a crash. This affects systems using Compute Express Link (CXL) devices.

• CVE-2026-53047MEDIUM 5.5

  A flaw in the Linux kernel's EFI capsule loader uses the wrong data size when expanding memory for storing physical hardware addresses. On 32-bit systems with PAE (Physical Address Extension), this miscalculation allocates half the space needed, risking a buffer overflow when the kernel writes address data. On common 64-bit systems, the error goes undetected because pointer and address sizes happen to match.

• CVE-2026-53048MEDIUM 5.5

  CVE-2026-53048 is a NULL pointer dereference vulnerability in the Linux kernel's GFS2 (Global File System 2) subsystem that can cause a system crash or denial of service during filesystem unmount operations. The issue occurs because the code attempts to access memory that has already been freed, triggering an unhandled exception. A local user with standard privileges can trigger this condition, making it a practical concern for systems running vulnerable kernel versions.

• CVE-2026-53051MEDIUM 5.5

  A flaw in the Linux kernel's Tegra194 PCI endpoint controller causes the system to hang when the PCI reset signal is toggled twice. The problem occurs because the driver tries to access certain hardware registers before the controller has been powered on. When the reset signal is deasserted (released), the initialization process attempts to clear memory regions by writing to registers that only work after the core is fully powered. This creates a hardware timeout that freezes the system. The fix reorders the initialization sequence so the core is powered on first, then the register access happens.

• CVE-2026-53052MEDIUM 5.5

  A flaw exists in the Linux kernel's QCOM DSP6 audio topology driver where the code accesses widget private data without first verifying the widget type. Virtual widgets—which don't map to actual DSP graph structures—can trigger incorrect memory access when processed. This is a local denial-of-service risk affecting systems using this audio subsystem.

• CVE-2026-53056MEDIUM 5.5

  A Linux kernel flaw in the display processor unit (DPU) driver can cause a mismatch between CPU power rail voltage and clock frequency during sleep-and-wake cycles. When the system suspends the display subsystem, the voltage drops to a minimal level but the clock speed doesn't follow, leaving them out of sync. On resume, this mismatch can cause instability or system crashes because the low voltage cannot support the high clock rate. The fix removes an incorrect power-down call that was causing the voltage to drop prematurely.

• CVE-2026-53058MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's Cadence MHDP8546 display bridge driver. When certain error conditions occur during display mode setup (specifically in the atomic_enable function), the driver attempts to access a data structure that hasn't been properly initialized, causing a system crash. The vulnerability affects systems using this display bridge controller, particularly in scenarios where the bridge connector is attached without an explicit connector object. An authenticated local attacker can trigger this by inducing error conditions in the display link initialization, resulting in a denial of service.

• CVE-2026-53060MEDIUM 5.5

  CVE-2026-53060 is a memory leak in the Linux kernel's device mapper cache subsystem. When the cache metadata system attempts to abort operations while the underlying block manager is in read-only mode, it fails to release a temporary block manager object, causing memory to accumulate. This occurs specifically during certain cache device table reload and resume operations. The leak is triggered by a sequence of suspend/resume cycles combined with metadata I/O errors, which can occur in production environments when cache devices encounter transient or permanent storage faults.

• CVE-2026-53061MEDIUM 5.5

  A flaw in the Linux kernel's device mapper cache subsystem can cause dirty data to be incorrectly loaded into passthrough mode, risking data loss. The issue arises because the kernel checks whether cached data is clean at the wrong time—during table setup rather than just before activation. When LVM preloads a new table configuration while metadata updates are still in progress, the validation fails to catch dirty blocks that should not enter passthrough mode. An attacker with local access and sufficient privileges could exploit this by creating a writeback cache, preloading a passthrough table, writing data to make blocks dirty, and then resuming the table, causing unintended data handling.

• CVE-2026-53063MEDIUM 5.5

  A flaw in the Linux kernel's device mapper cache subsystem causes write operations to hang when the cache is running in passthrough mode and invalidation occurs. The bug stems from incomplete logic in the invalidate_remove() function that sets up write requests but fails to submit them, leaving applications waiting indefinitely for I/O completion. This is a local issue requiring kernel privileges to trigger, but can severely disrupt system stability.

• CVE-2026-53064MEDIUM 5.5

  CVE-2026-53064 is a null pointer dereference flaw in the Linux kernel's dm-cache subsystem that occurs when the cache device is operating in passthrough mode and concurrent writes target the same cached block during cache invalidation. When the bio prison cell lock acquisition fails due to contention, the code attempts to unlock a cell that was never successfully locked, resulting in a kernel crash. This is a local denial-of-service vulnerability requiring local system access and can be triggered through concurrent I/O operations.

• CVE-2026-53065MEDIUM 5.5

  A memory resource leak has been identified in the Linux kernel's STi audio driver. When the driver is loaded and unloaded, certain internal data structures are not properly cleaned up, allowing memory to accumulate over time. While this doesn't directly compromise data or enable unauthorized access, repeated driver loads and unloads can degrade system stability and consume available memory resources. The fix is straightforward: the kernel team updated the code to use automatic resource management, ensuring these structures are freed when the driver is no longer needed.

• CVE-2026-53066MEDIUM 5.5

  A bug in the Linux kernel's graphics driver for certain ARM-based systems (sun4i backend) fails to properly validate error conditions when retrieving GPU plane state. An unprivileged local user can trigger this code path and cause a kernel crash (denial of service), but cannot execute code or escalate privileges.

• CVE-2026-53073MEDIUM 5.5

  A flaw in the Linux kernel's Bluetooth subsystem can cause a denial of service when the Bluetooth UART driver fails to properly initialize. Specifically, when device registration fails, a flag indicating successful protocol initialization is not cleared before releasing resources. This creates a window where incoming Bluetooth data over UART can trigger handlers that access memory that has already been freed, causing the system to crash. The issue affects local users with appropriate permissions and requires exploitation through Bluetooth UART interfaces.

• CVE-2026-53074MEDIUM 5.5

  CVE-2026-53074 is a denial-of-service vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) test framework. The vulnerability occurs when the kernel attempts to test BPF programs using artificially crafted network packets. Specifically, when a test packet claims to be IPv4 or IPv6 but lacks the required network header data, the kernel can crash or hang because it tries to read header information that doesn't exist in the packet. The fix ensures the kernel validates that sufficient packet data is present before attempting to access network headers, preventing the crash.

• CVE-2026-53079MEDIUM 5.5

  A memory leak exists in the Linux kernel's network packet scheduling subsystem. When the kernel defers cleanup of dropped packets, a mechanism designed to optimize performance can fail to free memory properly if certain conditions aren't met. Specifically, if a network queue (qdisc) doesn't have the TCQ_F_DEQUEUE_DROPS optimization flag enabled, packets marked for deletion get stranded in memory instead of being released. This causes the kernel to gradually consume more memory over time as network traffic is processed, potentially leading to system slowdown or denial of service if memory exhaustion occurs.

• CVE-2026-53080MEDIUM 5.5

  A flaw in the Linux kernel's traffic control (TC) packet classifier subsystem can trigger a kernel crash. Specifically, when using the 'fw' (firewall mark) classifier on shared traffic control blocks, the kernel may attempt to process an invalid filter before it is fully initialized. This creates a race condition where incoming packets hit code paths that dereference NULL pointers, causing a kernel panic. The vulnerability is triggered by a sequence of TC filter additions on a shared egress block combined with active packet transmission. While the issue requires local access and a privileged user account to set up malicious TC rules, the crash itself is a denial of service against the entire system.

• CVE-2026-53082MEDIUM 5.5

  A flaw in the Linux kernel's ham radio 6pack driver causes the system to process corrupted data bytes that should be skipped. When the TTY (terminal) layer detects transmission errors, it marks those bytes with error flags. The vulnerable code ignores these flags and attempts to decode the bad bytes anyway, leading to the kernel reading from uninitialized memory. An unprivileged local user with access to a 6pack device could trigger this condition, potentially causing a denial of service.

• CVE-2026-53083MEDIUM 5.5

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem can cause the system to become unresponsive when clearing certain types of maps with many entries. The issue occurs in the cleanup routine that removes file descriptors from PROG_ARRAY maps—a core data structure used by the kernel's in-kernel virtual machine. When processing large maps, the cleanup loop does not yield control back to the scheduler, starving the kernel's RCU (Read-Copy-Update) synchronization mechanism and triggering watchdog warnings. This is a local denial-of-service condition that requires authenticated access to trigger.

• CVE-2026-53084MEDIUM 5.5

  A lock ordering vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) task virtual memory area (VMA) iterator. The issue occurs when the kernel holds a per-VMA lock while executing a BPF program, which can lead to a circular lock dependency when BPF helper functions try to acquire locks that depend on the memory map lock. This can cause system deadlocks or denial of service. The fix snapshots the VMA data structure while holding the lock, then releases the lock before the BPF program executes, eliminating the circular dependency. The vulnerability requires local access and does not allow privilege escalation or information disclosure.

• CVE-2026-53093MEDIUM 5.5

  A flaw in the Linux kernel's Broadcom WiFi driver (brcmfmac) allows a local user to trigger a system crash by exploiting improper error handling. When the driver adds a wireless core component during initialization, it fails to check whether the operation succeeded or returned an error. An unprivileged local attacker can cause the system to dereference invalid memory, leading to a denial of service.

• CVE-2026-53095MEDIUM 5.5

  A vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem allows unprivileged local users to corrupt kernel function arguments through a chain of two eBPF programs. By combining a kprobe program (which monitors kernel functions) with a freplace program (which wraps or replaces other programs), an attacker can manipulate CPU registers that control function parameters, causing the kernel to execute with altered behavior. This could lead to a denial of service or logic corruption within the kernel.

• CVE-2026-53099MEDIUM 5.5

  A configuration naming issue in the Linux kernel's Control Flow Integrity (CFI) implementation causes security-critical code to be inadvertently excluded during compilation. When the kernel build system uses an outdated configuration option name (CONFIG_CFI_CLANG) instead of the current standard (CONFIG_CFI), the CFI protection mechanism for destructors in BPF programs fails to activate, leaving those code paths vulnerable to control flow attacks. This affects systems built with the incorrect configuration flag, potentially on any architecture where CFI is intended as a defense.

• CVE-2026-53100MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's WiFi driver (mt76) that can cause the system to hang when using the remain-on-channel feature. The issue occurs because two related functions attempt to acquire the same lock while already holding it, creating a circular wait condition. This leads to a denial of service where WiFi functionality becomes unresponsive until the system is restarted.

• CVE-2026-53101MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's MT7921 Wi-Fi driver that can freeze the system during Wi-Fi station removal. When the driver attempts to safely stop a background work queue, it can become stuck waiting for that work queue to finish—but the work queue itself is blocked trying to acquire a lock that the waiting code already holds. This creates a mutual deadlock where neither side can proceed. The issue occurs specifically when removing a Wi-Fi station connection, a routine operation that could be triggered by normal device management or user actions.

• CVE-2026-53102MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's MediaTek WiFi driver (mt76) where allocated memory is not properly freed when certain operations fail during station configuration. The vulnerability occurs when intermediate functions encounter errors after memory is allocated but before it can be properly released, potentially leading to memory exhaustion over time. This is a kernel-level issue that affects systems with MediaTek WiFi hardware running vulnerable kernel versions.

• CVE-2026-53103MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 devices can cause the system to become unresponsive when removing a wireless station. The issue stems from a deadlock condition where two parts of the driver code try to acquire the same lock, with one waiting for the other to release it—but that other code is blocked waiting for the first to finish. This creates a circular dependency that halts progress. The problem surfaces specifically during station removal operations when the driver attempts to abort pending radio operations.

• CVE-2026-53104MEDIUM 5.5

  A memory leak exists in the Linux kernel's MT76 WiFi driver that occurs during device destruction or module unload. The issue affects how receive (RX) queues manage associated memory pools—specifically, page pools are not properly cleaned up even when queues lack NAPI association, such as WED RRO (Ring Resource Optimize) queues when WED (Wireless Ethernet Dispatch) is enabled. This causes memory to remain allocated and inaccessible after the driver unloads, degrading system resource availability over time or after repeated driver restarts.

• CVE-2026-53105MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 chipsets can cause the system to crash if the driver attempts to process network transmission without proper initialization. The vulnerability exists because the code tries to access data from an uninitialized network interface object without first checking whether that object exists. An attacker with local access to a system running the affected driver could trigger this crash, causing a denial of service.

• CVE-2026-53106MEDIUM 5.5

  CVE-2026-53106 is a deadlock vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) local storage subsystem. The issue occurs when code running in NMI (Non-Maskable Interrupt) context attempts to delete local storage entries, which can cause the system to hang. The kernel developers have implemented a targeted fix that prevents deletion operations from proceeding when called from NMI context, returning an error instead of allowing the unsafe operation to proceed.

• CVE-2026-53107MEDIUM 5.5

  A flaw was found in how the Linux kernel's libertas WiFi driver handles USB data transmission. The driver was using a function that blocks (pauses) to prevent multiple transmission requests from overlapping, but this function can be called during interrupt handling—a special CPU context where blocking operations are forbidden. This mismatch can cause the system to sleep when it shouldn't, leading to kernel instability. The fix changes the approach: instead of forcefully stopping in-flight USB requests, the driver now checks whether a request is already pending and returns an error if one is, avoiding the problematic blocking call during interrupt handling.

• CVE-2026-53111MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the test_run functionality used to validate BPF programs. When certain BPF encapsulation helper functions attempt to access network device information during testing, they may crash the kernel if the test framework hasn't properly initialized the socket buffer's destination reference. This is a local denial-of-service issue that requires user-level access to trigger.

• CVE-2026-53113MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's WiFi driver (ath11k) that affects beacon template setup functions. When these functions encounter errors during parameter setup, they fail to properly release allocated memory for beacon templates. This can cause memory to accumulate over time, eventually degrading system performance or causing denial of service on affected devices, particularly WiFi access points and embedded systems running the vulnerable kernel code.

• CVE-2026-53114MEDIUM 5.5

  A flaw in the Linux kernel's AMD IBS (Instruction-Based Sampling) performance monitoring code allows a local attacker with limited privileges to trigger a fatal system crash. The vulnerability stems from the performance monitoring subsystem making an unsafe function call (perf_allow_kernel) directly from an NMI interrupt handler—a low-level, non-maskable interrupt context where such calls are dangerous. The fix relocates this permission check to event initialization time, caching the result so the NMI handler no longer needs to invoke the unsafe function.

• CVE-2026-53121MEDIUM 5.5

  A memory leak has been identified in the Linux kernel's AMD P-State driver, specifically in the CPU initialization code path. When the driver fails to configure power efficiency settings during CPU initialization, it deallocates resources improperly, leaving allocated memory orphaned in the system. Over time, repeated initialization failures could accumulate unused memory, degrading system stability and performance. This vulnerability requires local access to trigger and affects systems running vulnerable kernel versions with AMD P-State enabled.

• CVE-2026-53122MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's btrfs filesystem when the flushoncommit mount option is enabled. The issue occurs when a reflink operation (copy-on-write file cloning) interacts badly with the transaction commit process. Specifically, when copying inline file data to an offset beyond the current file size, a race condition can cause two kernel tasks to deadlock: one waiting on a file extent lock held by the other, while the other waits for a transaction to complete. This results in a system hang that can freeze processes and make the system unresponsive.

• CVE-2026-53123MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's RAID 5/6 reshape process. When direct I/O operations cross a reshape boundary, they wait for reshape progress while holding system references. If a user freezes the reshape and attempts to suspend the RAID array, the kernel can deadlock: the waiting I/O operations need reshape to continue, but the reshape thread is frozen, preventing the I/O from completing and suspension from finishing. This affects systems using md-raid arrays that perform live reshaping with concurrent I/O.

• CVE-2026-53124MEDIUM 5.5

  A vulnerability in the Linux kernel's ublk (userspace block device) subsystem can cause I/O cancellation to hang indefinitely when a userspace server process crashes during device recovery. The issue stems from how cancellation flags are managed: when a ublk server dies mid-recovery after fetching only some of the pending I/O operations, those fetched operations retain their cancellation flags and cannot be properly completed. This leaves I/O commands in a stuck state, potentially preventing graceful recovery or shutdown of the affected block device. The fix resets the cancellation flag for each I/O as it is fetched, rather than deferring this reset until all operations for a queue have been processed.

• CVE-2026-53125MEDIUM 5.5

  This is a Linux kernel bug that causes a deadlock when administrators try to clear an MD (multiple device) RAID array via the sysfs interface. When the "clear" command is issued, the kernel's internal locking mechanism gets confused about object ownership and tries to acquire the same lock twice simultaneously, causing the system to hang. The issue stems from improper reference counting—the kernel drops a reference to the array object too early, before properly releasing control of a protective mechanism that sysfs uses. This prevents legitimate array management operations and can make systems unresponsive.

• CVE-2026-53126MEDIUM 5.5

  A memory leak exists in the Linux kernel's block I/O (blk-cgroup) subsystem. When certain disk throttling operations fail internally, the kernel forgets to release a reference to the disk device, preventing it from being properly freed from memory. This causes a resource leak that accumulates over time as the system handles throttling requests, potentially leading to memory exhaustion or system instability. The bug was introduced when the kernel code was refactored to use a different internal data structure.

• CVE-2026-53127MEDIUM 5.5

  CVE-2026-53127 is a memory leak vulnerability in the Linux kernel's block device subsystem. When the kernel attempts to revalidate disk zones—a routine operation for certain storage hardware—and encounters an error, it fails to properly clean up allocated memory. This leaked memory accumulates over time, potentially causing system instability or service disruption on affected Linux systems.

• CVE-2026-53128MEDIUM 5.5

  A vulnerability in the Linux kernel's DRBD (Distributed Replicated Block Device) subsystem involves incorrect handling of RCU (Read-Copy-Update) synchronization primitives in the drbd_adm_dump_devices() function. The function calls rcu_read_unlock() without a corresponding prior call to rcu_read_lock(), creating an imbalance in RCU lock management. This can lead to kernel stability issues and potential denial of service. The defect was identified through automated static analysis using the Clang thread-safety checker.

• CVE-2026-53134MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem can leak uninitialized kernel memory to unprivileged local users. When the netfilter FIB module processes certain lookup failures or network interface checks, it fails to properly clear all memory locations it claims to initialize, leaving stale stack data accessible to userspace code. An attacker with local access could read sensitive kernel information through carefully crafted netfilter rules.

• CVE-2026-53135MEDIUM 5.5

  A flaw in the Linux kernel's AMD display driver debugfs interface can cause system crashes when users interact with a specific debug file. The vulnerability occurs in two ways: first, the code assumes a graphics connector is always attached to an active display pipeline, but this isn't true during hot-plug events or temporary disconnections—attempting to debug while in this state triggers a null pointer crash. Second, the same function blindly copies 36 bytes from user input regardless of how much data was actually provided, potentially reading beyond the user's buffer. Both issues require local access with standard user privileges to exploit.

• CVE-2026-53139MEDIUM 5.5

  A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) v3d driver allows local users to cause a denial of service by submitting graphics compute shader dispatch jobs with zero workgroup dimensions. When a compute shader is kicked off with zero counts in any dimension, the kernel should treat this as a no-op and skip execution; instead, the driver was allowing the submission through to hardware, which would misinterpret the zero as 65536—exceeding the valid maximum of 65535 and potentially causing system instability or hangs. This issue is particularly relevant for indirect compute shader dispatch jobs, where workgroup counts are only known at runtime from buffer contents.

• CVE-2026-53140MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) v3d driver. When processing compute shader dispatch (CSD) jobs with indirect workgroup counts, the driver fails to properly clean up memory mappings if any workgroup count is zero. This causes virtual address mappings to remain allocated, gradually consuming kernel memory. The issue is localized to a single code path and requires local access to exploit, making it a moderate risk to systems where untrusted local users can submit graphics workloads.

• CVE-2026-53141MEDIUM 5.5

  CVE-2026-53141 is a memory leak vulnerability in the Linux kernel's Direct Rendering Manager (DRM) v3d graphics driver. The vulnerability exists in the performance monitor reference counting logic, where the kernel fails to properly release memory references in three specific code paths. An unprivileged local user could trigger these memory leaks through GPU-related system calls, gradually exhausting kernel memory and causing system instability or denial of service. The vulnerability requires local access and does not enable privilege escalation or data theft.

• CVE-2026-53142MEDIUM 5.5

  The Linux kernel's xe graphics driver can crash when a system suspends or shuts down on certain Intel hardware where the display is disabled by hardware fuses. The driver keeps track of whether display hardware should be active, but fails to update this state when display is disabled after initial detection. This causes the driver to attempt operations on an uninitialized display configuration, resulting in a crash. The issue affects users with Intel GPUs where display functionality is hardware-disabled, particularly during power management transitions.

• CVE-2026-53144MEDIUM 5.5

  A flaw in the Linux kernel's AMD KFD (Kernel Fusion Driver) module can crash the system when a user-mode application provides invalid parameters to a debug trap function. Specifically, when an application requests to suspend GPU queues but supplies a non-zero queue count without a valid queue pointer, the kernel attempts to dereference a NULL pointer, triggering a panic. An unprivileged local user can exploit this to cause a denial of service.

• CVE-2026-53150MEDIUM 5.5

  A flaw in the Linux kernel's Thunderbolt subsystem allows a local attacker with standard user privileges to crash the system by supplying a specially crafted zero-length property entry. The vulnerability exists in the validation logic that checks incoming Thunderbolt XDomain properties; when a TEXT property has zero length, the code attempts to null-terminate a string at an invalid memory location, causing a buffer underflow. This is a denial-of-service issue affecting local system stability.

• CVE-2026-53152MEDIUM 5.5

  A NULL-pointer dereference vulnerability exists in the Linux kernel's Rockchip eMMC controller driver affecting very old SoC variants (RK2928, RK3066, RK3188). These legacy controllers lack support for high-speed UHS modes and traditionally had minimal driver initialization. A recent kernel commit added memory clock auto-gating logic that assumes driver private data exists, causing the old controllers to crash when they access uninitialized memory structures. The vulnerability requires local access and results in denial of service.

• CVE-2026-53154MEDIUM 5.5

  CVE-2026-53154 is a memory management bug in the Linux kernel's handling of huge pages (a performance optimization for large memory allocations). When the kernel tries to copy a huge page and that copy fails—for example, because the source page is corrupted (hwpoisoned)—it doesn't properly restore the memory reservation that was consumed for that operation. This leaves a task unable to use memory it had reserved, potentially causing it to crash with a SIGBUS signal later. The issue affects two specific code paths: copying huge pages during fork operations and when using the userfaultfd mechanism for memory fault handling.

• CVE-2026-53155MEDIUM 5.5

  A bug in the Linux kernel's memory management code corrupts the state of anonymous page tracking when device-private memory (used by GPUs and accelerators) is involved. The kernel incorrectly interprets memory flags when migrating pages between RAM and device memory, leading to assertions that crash the system. The issue surfaces in scenarios where a process with child processes (fork) migrates memory to and from device-private storage, particularly with large pages. A local user can trigger this by running specific memory-migration workloads.

• CVE-2026-53158MEDIUM 5.5

  CVE-2026-53158 is a NULL pointer dereference in the Linux kernel's fastrpc driver that can cause a system crash during boot on Qualcomm Snapdragon platforms. The vulnerability occurs when the DSP (Digital Signal Processor) sends a message to the kernel before the fastrpc driver finishes initializing. The kernel tries to access an uninitialized data structure, leading to a crash. This is a local availability issue requiring local access, affecting systems running vulnerable kernel versions on affected Qualcomm platforms.

• CVE-2026-53163MEDIUM 5.5

  CVE-2026-53163 is a null pointer dereference vulnerability in the Linux kernel's real-time mutex (rtmutex) locking mechanism. The flaw occurs when the kernel attempts to remove a waiter from a mutex queue without first verifying that the waiter is actually enqueued. This can happen during certain futex (fast userspace mutex) operations, particularly FUTEX_CMP_REQUEUE_PI calls. An unprivileged local user with limited access can trigger this condition, causing the kernel to crash and resulting in a denial of service. The vulnerability stems from incomplete deadlock detection logic that fails to properly initialize a waiter structure before the kernel later tries to clean it up.

• CVE-2026-53164MEDIUM 5.5

  A flaw in the Linux kernel's I/O memory management unit (IOMMU) and DMA handling can cause a system crash or hang when certain NVMe drives—particularly Thunderbolt-based SSDs—trigger software I/O translation lookaside buffer (SWIOTLB) operations with unaligned memory buffers. The kernel incorrectly attempts to map a zero-length memory region, fails, and then corrupts the mapping during error recovery. This is most commonly triggered by smartctl passthrough commands on affected Thunderbolt NVMe hardware.

• CVE-2026-53167MEDIUM 5.5

  A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows uninitialized memory to be accessed through the FUSE_NOTIFY_RETRIEVE operation. The issue arises because FUSE_NOTIFY_RETRIEVE can return data from page cache entries that haven't been properly initialized, potentially exposing sensitive information from kernel memory. The vulnerability only has meaningful security impact on systems that don't automatically zero-initialize memory allocations at boot time—most modern distributions enable this protection by default.

• CVE-2026-53168MEDIUM 5.5

  A vulnerability exists in the Linux kernel's FUSE (Filesystem in Userspace) subsystem where the pagecache notification operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE can be exploited to directly manipulate kernel-internal directory cache structures. These operations were intended for regular files only, but the kernel failed to properly validate request targets. An unprivileged local attacker could weaponize this to inject bogus data into directory caches, triggering kernel warnings and potentially causing denial of service or unexpected behavior. The fix restricts these operations to regular files and rejects misuse with an error code.

• CVE-2026-53169MEDIUM 5.5

  CVE-2026-53169 is a denial-of-service vulnerability in the Linux kernel's Ethos-U NPU driver. When userspace sends an unsupported NPU_OP_RESIZE command through the DRM interface, the driver's placeholder code unconditionally triggers a kernel warning. On systems configured to panic on warnings, any user with access to the DRM device can crash the kernel. The fix replaces the warning trigger with a proper error rejection, preventing both the spam and potential panic.

• CVE-2026-53177MEDIUM 5.5

  A vulnerability in the Linux kernel's Broadcom NetXtreme driver can cause a system crash when PCIe error recovery runs on a network interface card that has been administratively closed. The driver attempts to access memory structures that only exist when the NIC is active, leading to a NULL pointer dereference. An attacker with local access could trigger a PCIe error condition to crash the system or cause denial of service.

• CVE-2026-53181MEDIUM 5.5

  A flaw in the Linux kernel's virtual socket (vsock) implementation causes a resource leak when establishing connections between a guest and host via VMCI (VMware Communications Interface). When a server fails to complete the connection handshake—due to malformed packets, memory allocation issues, or event subscription problems—the kernel fails to properly clean up its internal connection tracking. Each failed attempt leaves a small piece of state behind, and after enough failures, the system silently rejects all new connection attempts. Restarting the affected process is the only recovery mechanism.

• CVE-2026-53190MEDIUM 5.5

  CVE-2026-53190 is a memory management bug in the Linux kernel's DRM (Direct Rendering Manager) virtio driver. When the driver attempts to wait on a DMA fence—a synchronization primitive used in graphics operations—it fails to properly release a reference to a fence object if an error occurs during the wait operation. This reference leak means memory is not freed as it should be, potentially leading to memory exhaustion if the condition is triggered repeatedly. The bug affects only the virtio GPU driver and requires local access to trigger.

• CVE-2026-53197MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's IPsec Traffic Flow Security (IPTFS) implementation. When the system destroys an IPTFS state object, it attempts to cancel two hardware timers while holding spinlocks that those same timers need to acquire. On multi-processor systems, this creates a circular wait condition where the main thread blocks waiting for timer callbacks to finish, while the timer callbacks block trying to acquire locks held by the main thread. The vulnerability was discovered through source code review rather than active exploitation.

• CVE-2026-53204MEDIUM 5.5

  The Linux kernel's Stratix10 RSU (Remote System Update) firmware driver contains a NULL pointer dereference vulnerability that can crash the system. When certain initialization messages time out during driver probe, the code incorrectly frees the communication channel but then tries to send additional messages on that same freed channel. The next kernel thread to run will crash when it attempts to access the freed channel structure. This is a local denial-of-service issue affecting systems with Intel Stratix10 hardware.

• CVE-2026-53206MEDIUM 5.5

  A flaw in the Linux kernel's Intel VPU (Video Processing Unit) driver fails to validate memory boundaries when loading firmware images. An attacker with local system access could craft a malicious firmware image with incorrect memory specifications, causing the kernel to attempt invalid memory allocation or access operations. This leads to a denial of service condition where the system or the affected driver becomes unavailable.

• CVE-2026-53207MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's memory failure handling code, specifically in how it manages hardware-poisoned huge pages. When two processes simultaneously call madvise(MADV_HWPOISON) on the same huge page while another thread unmaps the page, the kernel attempts to acquire the same spinlock twice, causing the system to hang. This is a kernel-level concurrency bug that requires local system access to trigger.

• CVE-2026-53208MEDIUM 5.5

  A flaw in the Linux kernel's Bluetooth BR/EDR (Basic Rate/Enhanced Data Rate) stack allows an unpaired attacker within radio range to trigger a denial-of-service condition. The vulnerability exists in the L2CAP (Logical Link Control and Adaptation Protocol) signaling layer, which fails to enforce the minimum packet size limit (MTUsig = 48 bytes) for Bluetooth signaling commands. An attacker can craft a single oversized signaling packet containing many ECHO_REQ (echo request) commands, forcing the target device to respond with numerous ECHO_RSP (echo response) frames, consuming bandwidth and processing resources without authentication.

• CVE-2026-53210MEDIUM 5.5

  CVE-2026-53210 is a memory leak vulnerability in the Linux kernel's TEE (Trusted Execution Environment) shared memory handler. When a user attempts to register shared memory with zero length via the TEE_IOC_SHM_REGISTER ioctl, the kernel allocates memory but fails to free it before exiting the error path, causing the allocated memory to leak. While the immediate impact is resource exhaustion rather than data exposure or privilege escalation, repeated triggering can degrade system stability on TEE-enabled systems.

• CVE-2026-53211MEDIUM 5.5

  A flaw in the Linux kernel's netfilter module causes uninitialized kernel memory to leak when certain network filtering rules access bridge device hardware addresses. When a netfilter rule requests the hardware address of an incoming interface on a bridge, the kernel writes only 6 bytes of the address into a register that is 8 bytes long, leaving 2 bytes of stale stack memory exposed. If a rule subsequently reads from that register, the uninitialized kernel data can be disclosed to a user-space application. The fix involves zeroing the full register before writing the hardware address.

• CVE-2026-53213MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) video core (vc4) driver. The issue occurs when the krealloc() function is called to resize allocated memory without properly checking its return value before overwriting the original pointer. If krealloc() fails and returns NULL, the original memory block becomes unreachable and is leaked. An unprivileged local user could trigger this condition repeatedly, exhausting system memory and causing a denial of service.

• CVE-2026-53214MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's IPv6 address configuration handling. When the kernel removes an IPv6 address, it attempts to clean up associated routing table entries. In certain conditions, it can reference a sentinel entry (a placeholder used internally) that lacks a valid routing table pointer, causing the kernel to crash. This affects local users with appropriate privileges and results in a denial-of-service condition. The vulnerability requires local access and appropriate user capabilities to trigger.

• CVE-2026-53218MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem allows a local, unprivileged user to trigger a condition where uninitialized memory is exposed through network packet filtering rules. When a specific flag (F_PRESENT) is used in netfilter extended header matching, the kernel incorrectly tracks which register storage areas have been written to, leaving portions of kernel stack memory accessible. This can lead to information disclosure or system instability.

• CVE-2026-53219MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem allows unprivileged local users to extract internal memory pointers used for performance counters. When retrieving firewall rule information, the kernel temporarily exposes the raw address of a per-CPU memory allocation before replacing it with sanitized data. If a user-space program causes a memory fault at precisely the right moment during this window, the raw pointer leaks out, potentially revealing kernel memory layout details that aid further exploitation.

• CVE-2026-53220MEDIUM 5.5

  A vulnerability in the Linux kernel's netfilter bridge module can cause a system crash when network packets are reinjected through the NFQUEUE mechanism after a bridge port has been removed or reassigned. The kernel fails to properly validate whether a bridge port still exists before attempting to process redirected traffic, leading to a null pointer dereference. While the immediate trigger requires local access and specific timing (removing a port between initial packet hook and reinject), the underlying validation gap represents a stability risk for systems relying on bridged network filtering.

• CVE-2026-53222MEDIUM 5.5

  A resource management issue exists in the Linux kernel's PTP (Precision Time Protocol) OCP driver. When the driver is unloaded, it frees pin resources before properly unregistering the PTP clock device. A recent kernel change causes the unregister process to reconfigure those already-freed pins, creating a use-after-free condition that can crash the system. The fix reorders operations so the clock is unregistered before pin resources are released, and ensures interrupt handlers are fully synchronized before cleanup.

• CVE-2026-53226MEDIUM 5.5

  A flaw in the Linux kernel's Rockchip GPIO driver causes memory and resource leaks when the driver is unloaded. Specifically, interrupt-handling structures allocated during driver initialization are not properly freed during removal. These orphaned structures remain registered globally and can be accessed by system callbacks after the hardware driver has already shut down, risking a crash. The fix requires explicitly cleaning up these structures before the driver fully unloads.

• CVE-2026-53227MEDIUM 5.5

  A memory management bug exists in the Linux kernel's Open vSwitch networking subsystem. When a network packet buffer fails to allocate during certain locking operations, the kernel attempts to free an invalid memory pointer, causing a crash. This vulnerability affects systems running vulnerable kernel versions, particularly in environments using Open vSwitch for virtualized networking.

• CVE-2026-53231MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's network PHY (physical layer) driver code. When the kernel uses its generic PHY driver (genphy) with SFP cage modules (small form-factor pluggable optical transceivers), an initialization sequence can cause the system to hang. The issue stems from improper handling of SFP bus setup under the RTNL (Real-Time NetLink) lock, which genphy acquires during probing but other PHY drivers do not. Systems attempting to initialize SFP cages through genphy will experience a complete deadlock, rendering network functionality unavailable until the system is restarted.

• CVE-2026-53236MEDIUM 5.5

  A vulnerability in the Linux kernel allows unprivileged users to attach Berkeley Packet Filter (cBPF) rules to TCP sockets in a way that could leak sensitive TCP connection information such as sequence and acknowledgment numbers. The fix restricts this socket option to only users with administrative network privileges (CAP_NET_ADMIN), preventing unprivileged applications from exploiting this side-channel to extract data about active TCP connections.

• CVE-2026-53237MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's mvebu GPIO driver during system suspend and resume operations. The driver unconditionally calls PWM-related suspend and resume functions for all GPIO banks, but not all banks have PWM functionality. When a GPIO bank without PWM is processed, the code attempts to access memory through a NULL pointer, causing the system to crash. This vulnerability can be triggered by any user with local access to initiate a system suspend, making it a straightforward denial-of-service condition on affected systems.

• CVE-2026-53238MEDIUM 5.5

  A flaw in the Linux kernel's network labeling subsystem allows a local attacker with user-level privileges to trigger an out-of-bounds memory read. The vulnerability stems from incomplete validation when processing network configuration requests—specifically, the code checks the length of an IP address field but fails to validate the corresponding network mask field in the same way. An attacker can craft a malicious request that provides a properly-formatted address but a deliberately short mask, causing the kernel to read beyond the mask field's actual size and access uninitialized memory. This leads to a denial of service through a kernel crash.

• CVE-2026-53241MEDIUM 5.5

  The Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer contains a memory access vulnerability in its dummy port implementation. When the dummy sequencer port processes Unified MIDI Protocol (UMP) events, it copies event data into a temporary buffer that is sized for legacy events rather than the larger UMP event format. This causes the system to read beyond the buffer's actual size when forwarding the event to subscribers, potentially causing a kernel crash or information leak. The issue affects systems using ALSA's sequencer functionality with UMP event handling enabled.

• CVE-2026-53243MEDIUM 5.5

  A bug in the Linux kernel's rseq (restartable sequences) subsystem allows an uninitialized stack variable to be read and potentially leaked to userspace. The issue stems from how the C compiler evaluates the initialization of a local structure; it may read from the `ids.cpu_id` field before that field has been assigned a value, causing kernel memory to be exposed. This is a local privilege escalation risk affecting Linux systems where unprivileged users can trigger the vulnerable code path.

• CVE-2026-53245MEDIUM 5.5

  A parsing bug in the Linux kernel's Media Redundancy Protocol (MRP) implementation can cause the network stack to misinterpret protocol frames. The vulnerability occurs in how the kernel parses vector attribute fields within MRP Protocol Data Units (PDUs). When processing event sequences, the parser fails to correctly track its position in some cases—particularly when the number of events is a multiple of three, or when certain optional fields are present or absent. This can lead to the kernel applying spurious state changes to MRP applicant state machines or corrupting the offset used to parse subsequent protocol data, potentially triggering a denial of service.