2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 22 of 41

• CVE-2026-52977MEDIUM 5.5

  A race condition in the Linux kernel's futex (fast userspace mutex) implementation can cause a system lockup when one task times out or receives a signal while waiting to be requeued to another futex. The issue arises because a departing task cannot remove itself from the queue quickly enough when a higher-priority task is holding the necessary locks, leading to deadlock or busy-loop scenarios that freeze the system. The fix involves properly removing waiters from the queue when requeue operations fail, allowing other tasks to progress and preventing the lockup condition.

• CVE-2026-52978MEDIUM 5.5

  A Linux kernel networking subsystem (PSP) fails to enforce proper permission checks on two critical operations: changing device settings (dev-set) and rotating cryptographic keys (key-rotate). Currently, any user on the system who has access to the network namespace can perform these operations, even though they modify shared device state that should be restricted to administrators. This allows unprivileged local users to tamper with PSP configuration and key material without needing root-level capabilities.

• CVE-2026-52979MEDIUM 5.5

  A flaw in the Linux kernel's PSP (Platform Security Processor) networking subsystem can lead to a denial-of-service condition. When creating a network association, the code obtains a reference to a PSP device but fails to verify the device is still active after acquiring a lock. This allows a device unregistration to proceed undetected, leaving the association code operating on stale or invalid device state, ultimately causing the system to crash or become unresponsive.

• CVE-2026-52980MEDIUM 5.5

  CVE-2026-52980 is a memory corruption and denial-of-service vulnerability in the Linux kernel scheduler that can be triggered by a combination of process forking and yield operations. When a new process is created, the kernel's fair scheduling class fails to properly initialize certain deadline tracking state, causing subsequent scheduler operations to compute abnormally large deadline values. If the affected process later yields, these inflated values cascade into corrupted internal accounting structures, potentially rendering the entire scheduler unable to pick runnable processes and causing a system crash. The vulnerability requires local access and unprivileged execution, making it a practical risk in multi-user and containerized Linux environments.

• CVE-2026-52984MEDIUM 5.5

  A flaw in the Linux kernel's network traffic scheduling (netem) module allows queue size limits to be bypassed when packets are reordered. The vulnerability occurs because the queue limit check only counts packets in one internal queue structure but ignores packets placed elsewhere during reordering, enabling total queue size to grow beyond configured limits. This can degrade system performance or cause denial of service conditions on systems relying on network queue limits for stability.

• CVE-2026-52985MEDIUM 5.5

  CVE-2026-52985 is a memory initialization bug in the Linux kernel's netdevsim module. When the kernel builds dummy network packets for trap simulation, it fails to properly zero-initialize the IP header structure, leaving uninitialized memory that can be read by subsequent code. This is a kernel memory safety issue rather than a direct network-exploitable vulnerability. The fix is straightforward: replace a memory allocation function with one that guarantees zeroed memory.

• CVE-2026-52990MEDIUM 5.5

  A vulnerability in the Linux kernel's file notification system causes an inode reference leak when monitoring marks are added and removed concurrently. When a file system mark transitions from being actively tracked to not, the kernel fails to properly release the inode reference, eventually causing processes (like umount) to hang indefinitely. This is a timing-sensitive race condition that requires specific concurrent activity to trigger.

• CVE-2026-52994MEDIUM 5.5

  A flaw in the Linux kernel's virtual socket (vsock) implementation over virtio transport allows unprivileged users to bypass memory resource limits (RLIMIT_MEMLOCK) when using zero-copy message operations. The bug occurs because the kernel fails to properly account for pinned memory pages on the final network packet, allowing an attacker with local access to pin more memory than their account should be permitted, potentially causing denial of service.

• CVE-2026-52995MEDIUM 5.5

  A vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) networking subsystem leaks uninitialized kernel memory to unprivileged local users. When certain RDS connection state queries are made, the kernel copies stack memory that was never properly initialized to user space, potentially exposing sensitive kernel addresses and data. The vulnerability affects code paths where the connection info visitor functions fail to populate all output fields before the buffer is returned to the caller.

• CVE-2026-52996MEDIUM 5.5

  A resource leak vulnerability exists in the Linux kernel's SMB server implementation (ksmbd). When a client attempts to reconnect to a file using durable handle version 2, the server may fail to properly release a reference to a file descriptor if the client's identifier doesn't match what's stored on the server. This causes server memory and file table entries to accumulate over time, potentially degrading performance or causing denial of service as the system exhausts resources.

• CVE-2026-52997MEDIUM 5.5

  A flaw in the Linux kernel's dualpi2 network queue management system can cause the system to crash when configuration changes are applied. The issue occurs when packets are routed to one queue while another queue is empty—the kernel tries to access data from the wrong location and encounters a NULL pointer, causing a denial of service. This vulnerability requires local access to trigger and affects systems using the dualpi2 qdisc for traffic shaping.

• CVE-2026-53001MEDIUM 5.5

  A vulnerability in the Linux kernel's netfilter xtables subsystem allows a local user with limited privileges to cause a denial-of-service condition. The issue stems from improper protocol family restrictions in certain packet filtering modules (xt_mac, xt_owner, xt_physdev, and xt_realm). By crafting specific netfilter rules, an attacker could trigger excessive resource consumption or system crashes. This is a low-privilege local attack with no remote exploitation path.

• CVE-2026-53007MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's Intel ice driver that can crash the system. The flaw occurs when the driver attempts to configure transmit ring parameters but fails partway through the operation. Specifically, the code fails to properly clean up a flag indicating that timestamp functionality is enabled, even though the underlying data structure has been nullified. During error recovery, the code then tries to access that nullified structure, causing a kernel panic. This requires local system access to trigger.

• CVE-2026-53012MEDIUM 5.5

  CVE-2026-53012 is a kernel bug affecting IPv6 routing in Linux. The issue occurs when an IPv6 nexthop (a routing destination point) is replaced with an IPv4 one, and the system fails to update its internal tracking flags. This mismatch causes the kernel to attempt operations on IPv4 routing data while treating it as IPv6, resulting in a crash when traffic tries to use the affected route. An unprivileged local user with network namespace privileges can trigger this by crafting specific routing configuration changes and then sending IPv6 traffic.

• CVE-2026-53013MEDIUM 5.5

  A flaw in the Linux kernel's macvlan networking driver causes a space-reservation mismatch in network interface information reporting. When a macvlan interface is configured with a broadcast cutoff setting other than the default, the kernel fails to allocate enough buffer space for the configuration data when querying interface details. This triggers a warning and prevents the interface from being reported, potentially causing network management tools to fail silently.

• CVE-2026-53014MEDIUM 5.5

  CVE-2026-53014 is a logic error in the Linux kernel's traffic control (tc) packet mirroring feature that causes the system to misidentify device types when redirecting network traffic to multiple destinations simultaneously. When a tc rule redirects packets to several devices at once—particularly when those devices have different underlying transmission modes (like an Ethernet interface versus a tunnel)—the kernel checks the wrong device's configuration, leading it to corrupt packet headers. In severe cases, this can cause the kernel to run out of memory and crash. The vulnerability requires local access to configure tc rules.

• CVE-2026-53015MEDIUM 5.5

  A bug in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation causes incorrect handling of logical cluster numbers on 32-bit systems. The vulnerability stems from using a 32-bit data type (`unsigned long` or `unsigned int`) for a value that can exceed 4 GiB when shifted by the cluster size multiplier. By unifying this value to a 64-bit type, the kernel prevents truncation and data corruption that could occur when the filesystem attempts to access or manipulate file locations beyond the 4 GiB boundary on 32-bit platforms.

• CVE-2026-53017MEDIUM 5.5

  A data loss vulnerability exists in the Linux kernel's F2FS file system implementation. The issue occurs when a newly created file is synchronized to disk (fsync) at the exact moment a checkpoint operation is in progress. Due to incorrect flag interpretation, the kernel may fail to write the file's inode block, resulting in permanent data loss. The vulnerability requires local access and specific timing, making it a moderate but serious threat to systems relying on F2FS for storage.

• CVE-2026-53018MEDIUM 5.5

  A bug in the Linux kernel's f2fs (Flash-Friendly File System) implementation can cause a crash when the garbage collector attempts to read a memory page that has already been updated and moved to a new location. During normal file system operations, a page may be relocated from one disk block to another and marked as up-to-date. If the garbage collector then tries to read that same page from its old location without checking its status first, it triggers a kernel panic. The fix prevents unnecessary read operations on pages that have already been refreshed, eliminating the crash condition.

• CVE-2026-53019MEDIUM 5.5

  A logic error in the Linux kernel's SpaceMIT clock control unit (CCU) driver causes the system to skip necessary frequency scaling operations. When the kernel attempts to change CPU frequency—a routine operation during power management—a reversed conditional check prevents the actual frequency change from being triggered, leading to kernel panics. This affects systems running the vulnerable kernel version on SpaceMIT-based hardware.

• CVE-2026-53021MEDIUM 5.5

  A bug in the Linux kernel's SCSI target subsystem fails to properly validate certain storage device commands. Specifically, when processing UNMAP requests (which deallocate storage blocks), the code checks that the operation stays within the device's capacity but misses cases where the arithmetic wraps around a 64-bit boundary. An authenticated local user could exploit this to trigger a denial-of-service condition by crashing the kernel or causing unexpected behavior.

• CVE-2026-53022MEDIUM 5.5

  A buffer overflow vulnerability exists in the Linux kernel's Dell WMI System Management driver. The driver aggregates firmware-provided configuration strings into fixed 512-byte buffers without properly checking whether all strings will fit. An attacker with local system access could craft malicious firmware data that causes the buffer to overflow, potentially crashing the system or enabling privilege escalation. The vulnerability requires local access and low-level privileges to exploit.

• CVE-2026-53023MEDIUM 5.5

  A flaw in the Linux kernel's NTFS3 file system driver can cause the system to read beyond the boundaries of a memory buffer when displaying a volume label. The problem occurs because the code that converts the volume label from UTF-16 to UTF-8 format doesn't properly null-terminate the resulting string. When a volume label exactly fills the available buffer space, the system may access memory locations outside the intended buffer, potentially causing a denial of service. This requires local access to the system and affects systems that mount NTFS volumes using the NTFS3 driver.

• CVE-2026-53027MEDIUM 5.5

  A bug in the Linux kernel's NTFS3 filesystem driver can cause the system to crash or become unstable when handling compressed or sparse file attributes with specific memory alignment characteristics. The issue occurs because the code fails to load necessary metadata for certain file clusters before attempting to allocate new storage space, leading to an unexpected warning condition that can trigger a kernel panic. This affects systems running vulnerable Linux kernels that use NTFS3, particularly those storing compressed or sparse files.

• CVE-2026-53028MEDIUM 5.5

  A coding error in the Linux kernel's USB Type-C driver can cause a system crash when the driver attempts to register a USB Type-C partner device and that registration fails. The code checks whether the registration failed but does not exit early; instead it continues executing and tries to use the failed result as if it were valid, leading to a crash. This affects systems with USB Type-C controllers using the TI TUSB322 driver.

• CVE-2026-53029MEDIUM 5.5

  A logic flaw in the Linux kernel's NTFS3 filesystem handler can cause the system to use an uninitialized memory value during certain file operations. When the kernel attempts to map file regions for input/output, it may fail to properly initialize a critical variable (lcn) under specific conditions, leading to a kernel crash. The issue occurs when handling files or filesystem states that trigger a zero-length condition without setting up required data structures first. An unprivileged local user can trigger this by attempting to read or write to specially crafted NTFS3 filesystem files.

• CVE-2026-53030MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Renesas i3c master driver. When the driver processes i3c transfer operations, it allocates internal data structures that are never properly freed, causing memory to accumulate over time. This can lead to denial of service if an attacker with local access repeatedly triggers the affected code path, eventually exhausting system memory and causing the kernel to become unstable or crash.

• CVE-2026-53032MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's eBPF map handling code. When a scalar register is incorrectly stored into a kernel pointer (kptr) slot, the kernel fails to validate the pointer type before attempting to dereference memory, causing a kernel crash. This is a local privilege issue that requires an attacker with local access and the ability to run eBPF programs.

• CVE-2026-53034MEDIUM 5.5

  A race condition in the Linux kernel's socket map (sockmap) implementation can cause a kernel crash when BPF programs attempt to update socket maps while Unix domain stream sockets are being connected. The vulnerability occurs because the kernel marks a socket as established before fully initializing its peer connection, creating a narrow window where a BPF sockmap update operation may dereference a null pointer. An attacker with local access and permission to load BPF programs could trigger this null-pointer dereference, causing a denial of service. The issue is resolved by adding a null-check in the Unix stream socket protocol update handler to ensure the peer socket is properly initialized before attempting to access it.

• CVE-2026-53035MEDIUM 5.5

  CVE-2026-53035 is a deadlock vulnerability in the Linux kernel's eBPF (Berkeley Packet Filter) subsystem, specifically within the Unix domain socket iterator and socket map components. When a BPF program iterates over Unix sockets and attempts to update a socket map during iteration, the kernel can deadlock because the same lock is acquired twice. This occurs because the iterator holds a fast-path lock on the socket, and the socket map update operation tries to acquire the same lock again, causing the system to hang. The vulnerability requires local access and elevated privileges to trigger.

• CVE-2026-53037MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's USB HID (Human Interface Device) driver reset handling. When a USB device combines HID functionality with storage or UAS (USB Attached SCSI) components, the kernel must reset all components together. The vulnerability occurs because memory allocation during the reset process can trigger block I/O operations, which deadlock against a mutex held during device reset. This causes the system to hang when such hybrid USB devices encounter errors requiring reset.

• CVE-2026-53038MEDIUM 5.5

  A vulnerability in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem can trigger a memory safety bug when the kernel attempts to look up hash algorithm names for TPM banks that the system doesn't recognize. Specifically, when a TPM chip reports support for a hash algorithm (like SHA3-256) that the kernel doesn't yet have in its algorithm table, the code sets an invalid index and later uses that index to access a global array of algorithm names, reading past the array bounds. This causes a kernel crash (denial of service) during system initialization. The issue is particularly relevant as newer TPM specifications include algorithms not yet reflected in all kernel versions.

• CVE-2026-53039MEDIUM 5.5

  A flaw in the Linux kernel's OCFS2 filesystem implementation allows a local user to trigger a kernel panic (denial of service) by providing specially crafted input to the OCFS2_IOC_GROUP_ADD ioctl. The vulnerability stems from the code attempting to cache group descriptor information before properly validating it, causing an assertion failure in the buffer management code.

• CVE-2026-53042MEDIUM 5.5

  A flaw in the Linux kernel's fwctl subsystem can cause the system to crash when removing certain devices. The issue stems from a module initialization ordering problem: the CXL driver loads before fwctl and tries to register devices before fwctl is ready, leaving internal data structures uninitialized. When those devices are later removed, the kernel attempts to clean up the uninitialized structures, triggering a crash. This affects systems using Compute Express Link (CXL) devices.

• CVE-2026-53047MEDIUM 5.5

  A flaw in the Linux kernel's EFI capsule loader uses the wrong data size when expanding memory for storing physical hardware addresses. On 32-bit systems with PAE (Physical Address Extension), this miscalculation allocates half the space needed, risking a buffer overflow when the kernel writes address data. On common 64-bit systems, the error goes undetected because pointer and address sizes happen to match.

• CVE-2026-53048MEDIUM 5.5

  CVE-2026-53048 is a NULL pointer dereference vulnerability in the Linux kernel's GFS2 (Global File System 2) subsystem that can cause a system crash or denial of service during filesystem unmount operations. The issue occurs because the code attempts to access memory that has already been freed, triggering an unhandled exception. A local user with standard privileges can trigger this condition, making it a practical concern for systems running vulnerable kernel versions.

• CVE-2026-53051MEDIUM 5.5

  A flaw in the Linux kernel's Tegra194 PCI endpoint controller causes the system to hang when the PCI reset signal is toggled twice. The problem occurs because the driver tries to access certain hardware registers before the controller has been powered on. When the reset signal is deasserted (released), the initialization process attempts to clear memory regions by writing to registers that only work after the core is fully powered. This creates a hardware timeout that freezes the system. The fix reorders the initialization sequence so the core is powered on first, then the register access happens.

• CVE-2026-53052MEDIUM 5.5

  A flaw exists in the Linux kernel's QCOM DSP6 audio topology driver where the code accesses widget private data without first verifying the widget type. Virtual widgets—which don't map to actual DSP graph structures—can trigger incorrect memory access when processed. This is a local denial-of-service risk affecting systems using this audio subsystem.

• CVE-2026-53056MEDIUM 5.5

  A Linux kernel flaw in the display processor unit (DPU) driver can cause a mismatch between CPU power rail voltage and clock frequency during sleep-and-wake cycles. When the system suspends the display subsystem, the voltage drops to a minimal level but the clock speed doesn't follow, leaving them out of sync. On resume, this mismatch can cause instability or system crashes because the low voltage cannot support the high clock rate. The fix removes an incorrect power-down call that was causing the voltage to drop prematurely.

• CVE-2026-53058MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's Cadence MHDP8546 display bridge driver. When certain error conditions occur during display mode setup (specifically in the atomic_enable function), the driver attempts to access a data structure that hasn't been properly initialized, causing a system crash. The vulnerability affects systems using this display bridge controller, particularly in scenarios where the bridge connector is attached without an explicit connector object. An authenticated local attacker can trigger this by inducing error conditions in the display link initialization, resulting in a denial of service.

• CVE-2026-53060MEDIUM 5.5

  CVE-2026-53060 is a memory leak in the Linux kernel's device mapper cache subsystem. When the cache metadata system attempts to abort operations while the underlying block manager is in read-only mode, it fails to release a temporary block manager object, causing memory to accumulate. This occurs specifically during certain cache device table reload and resume operations. The leak is triggered by a sequence of suspend/resume cycles combined with metadata I/O errors, which can occur in production environments when cache devices encounter transient or permanent storage faults.

• CVE-2026-53061MEDIUM 5.5

  A flaw in the Linux kernel's device mapper cache subsystem can cause dirty data to be incorrectly loaded into passthrough mode, risking data loss. The issue arises because the kernel checks whether cached data is clean at the wrong time—during table setup rather than just before activation. When LVM preloads a new table configuration while metadata updates are still in progress, the validation fails to catch dirty blocks that should not enter passthrough mode. An attacker with local access and sufficient privileges could exploit this by creating a writeback cache, preloading a passthrough table, writing data to make blocks dirty, and then resuming the table, causing unintended data handling.

• CVE-2026-53063MEDIUM 5.5

  A flaw in the Linux kernel's device mapper cache subsystem causes write operations to hang when the cache is running in passthrough mode and invalidation occurs. The bug stems from incomplete logic in the invalidate_remove() function that sets up write requests but fails to submit them, leaving applications waiting indefinitely for I/O completion. This is a local issue requiring kernel privileges to trigger, but can severely disrupt system stability.

• CVE-2026-53064MEDIUM 5.5

  CVE-2026-53064 is a null pointer dereference flaw in the Linux kernel's dm-cache subsystem that occurs when the cache device is operating in passthrough mode and concurrent writes target the same cached block during cache invalidation. When the bio prison cell lock acquisition fails due to contention, the code attempts to unlock a cell that was never successfully locked, resulting in a kernel crash. This is a local denial-of-service vulnerability requiring local system access and can be triggered through concurrent I/O operations.

• CVE-2026-53065MEDIUM 5.5

  A memory resource leak has been identified in the Linux kernel's STi audio driver. When the driver is loaded and unloaded, certain internal data structures are not properly cleaned up, allowing memory to accumulate over time. While this doesn't directly compromise data or enable unauthorized access, repeated driver loads and unloads can degrade system stability and consume available memory resources. The fix is straightforward: the kernel team updated the code to use automatic resource management, ensuring these structures are freed when the driver is no longer needed.

• CVE-2026-53066MEDIUM 5.5

  A bug in the Linux kernel's graphics driver for certain ARM-based systems (sun4i backend) fails to properly validate error conditions when retrieving GPU plane state. An unprivileged local user can trigger this code path and cause a kernel crash (denial of service), but cannot execute code or escalate privileges.

• CVE-2026-53073MEDIUM 5.5

  A flaw in the Linux kernel's Bluetooth subsystem can cause a denial of service when the Bluetooth UART driver fails to properly initialize. Specifically, when device registration fails, a flag indicating successful protocol initialization is not cleared before releasing resources. This creates a window where incoming Bluetooth data over UART can trigger handlers that access memory that has already been freed, causing the system to crash. The issue affects local users with appropriate permissions and requires exploitation through Bluetooth UART interfaces.

• CVE-2026-53074MEDIUM 5.5

  CVE-2026-53074 is a denial-of-service vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) test framework. The vulnerability occurs when the kernel attempts to test BPF programs using artificially crafted network packets. Specifically, when a test packet claims to be IPv4 or IPv6 but lacks the required network header data, the kernel can crash or hang because it tries to read header information that doesn't exist in the packet. The fix ensures the kernel validates that sufficient packet data is present before attempting to access network headers, preventing the crash.

• CVE-2026-53079MEDIUM 5.5

  A memory leak exists in the Linux kernel's network packet scheduling subsystem. When the kernel defers cleanup of dropped packets, a mechanism designed to optimize performance can fail to free memory properly if certain conditions aren't met. Specifically, if a network queue (qdisc) doesn't have the TCQ_F_DEQUEUE_DROPS optimization flag enabled, packets marked for deletion get stranded in memory instead of being released. This causes the kernel to gradually consume more memory over time as network traffic is processed, potentially leading to system slowdown or denial of service if memory exhaustion occurs.

• CVE-2026-53080MEDIUM 5.5

  A flaw in the Linux kernel's traffic control (TC) packet classifier subsystem can trigger a kernel crash. Specifically, when using the 'fw' (firewall mark) classifier on shared traffic control blocks, the kernel may attempt to process an invalid filter before it is fully initialized. This creates a race condition where incoming packets hit code paths that dereference NULL pointers, causing a kernel panic. The vulnerability is triggered by a sequence of TC filter additions on a shared egress block combined with active packet transmission. While the issue requires local access and a privileged user account to set up malicious TC rules, the crash itself is a denial of service against the entire system.

• CVE-2026-53082MEDIUM 5.5

  A flaw in the Linux kernel's ham radio 6pack driver causes the system to process corrupted data bytes that should be skipped. When the TTY (terminal) layer detects transmission errors, it marks those bytes with error flags. The vulnerable code ignores these flags and attempts to decode the bad bytes anyway, leading to the kernel reading from uninitialized memory. An unprivileged local user with access to a 6pack device could trigger this condition, potentially causing a denial of service.

• CVE-2026-53083MEDIUM 5.5

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem can cause the system to become unresponsive when clearing certain types of maps with many entries. The issue occurs in the cleanup routine that removes file descriptors from PROG_ARRAY maps—a core data structure used by the kernel's in-kernel virtual machine. When processing large maps, the cleanup loop does not yield control back to the scheduler, starving the kernel's RCU (Read-Copy-Update) synchronization mechanism and triggering watchdog warnings. This is a local denial-of-service condition that requires authenticated access to trigger.

• CVE-2026-53084MEDIUM 5.5

  A lock ordering vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) task virtual memory area (VMA) iterator. The issue occurs when the kernel holds a per-VMA lock while executing a BPF program, which can lead to a circular lock dependency when BPF helper functions try to acquire locks that depend on the memory map lock. This can cause system deadlocks or denial of service. The fix snapshots the VMA data structure while holding the lock, then releases the lock before the BPF program executes, eliminating the circular dependency. The vulnerability requires local access and does not allow privilege escalation or information disclosure.

• CVE-2026-53093MEDIUM 5.5

  A flaw in the Linux kernel's Broadcom WiFi driver (brcmfmac) allows a local user to trigger a system crash by exploiting improper error handling. When the driver adds a wireless core component during initialization, it fails to check whether the operation succeeded or returned an error. An unprivileged local attacker can cause the system to dereference invalid memory, leading to a denial of service.

• CVE-2026-53095MEDIUM 5.5

  A vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem allows unprivileged local users to corrupt kernel function arguments through a chain of two eBPF programs. By combining a kprobe program (which monitors kernel functions) with a freplace program (which wraps or replaces other programs), an attacker can manipulate CPU registers that control function parameters, causing the kernel to execute with altered behavior. This could lead to a denial of service or logic corruption within the kernel.

• CVE-2026-53099MEDIUM 5.5

  A configuration naming issue in the Linux kernel's Control Flow Integrity (CFI) implementation causes security-critical code to be inadvertently excluded during compilation. When the kernel build system uses an outdated configuration option name (CONFIG_CFI_CLANG) instead of the current standard (CONFIG_CFI), the CFI protection mechanism for destructors in BPF programs fails to activate, leaving those code paths vulnerable to control flow attacks. This affects systems built with the incorrect configuration flag, potentially on any architecture where CFI is intended as a defense.

• CVE-2026-53100MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's WiFi driver (mt76) that can cause the system to hang when using the remain-on-channel feature. The issue occurs because two related functions attempt to acquire the same lock while already holding it, creating a circular wait condition. This leads to a denial of service where WiFi functionality becomes unresponsive until the system is restarted.

• CVE-2026-53101MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's MT7921 Wi-Fi driver that can freeze the system during Wi-Fi station removal. When the driver attempts to safely stop a background work queue, it can become stuck waiting for that work queue to finish—but the work queue itself is blocked trying to acquire a lock that the waiting code already holds. This creates a mutual deadlock where neither side can proceed. The issue occurs specifically when removing a Wi-Fi station connection, a routine operation that could be triggered by normal device management or user actions.

• CVE-2026-53102MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's MediaTek WiFi driver (mt76) where allocated memory is not properly freed when certain operations fail during station configuration. The vulnerability occurs when intermediate functions encounter errors after memory is allocated but before it can be properly released, potentially leading to memory exhaustion over time. This is a kernel-level issue that affects systems with MediaTek WiFi hardware running vulnerable kernel versions.

• CVE-2026-53103MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 devices can cause the system to become unresponsive when removing a wireless station. The issue stems from a deadlock condition where two parts of the driver code try to acquire the same lock, with one waiting for the other to release it—but that other code is blocked waiting for the first to finish. This creates a circular dependency that halts progress. The problem surfaces specifically during station removal operations when the driver attempts to abort pending radio operations.

• CVE-2026-53104MEDIUM 5.5

  A memory leak exists in the Linux kernel's MT76 WiFi driver that occurs during device destruction or module unload. The issue affects how receive (RX) queues manage associated memory pools—specifically, page pools are not properly cleaned up even when queues lack NAPI association, such as WED RRO (Ring Resource Optimize) queues when WED (Wireless Ethernet Dispatch) is enabled. This causes memory to remain allocated and inaccessible after the driver unloads, degrading system resource availability over time or after repeated driver restarts.

• CVE-2026-53105MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 chipsets can cause the system to crash if the driver attempts to process network transmission without proper initialization. The vulnerability exists because the code tries to access data from an uninitialized network interface object without first checking whether that object exists. An attacker with local access to a system running the affected driver could trigger this crash, causing a denial of service.

• CVE-2026-53106MEDIUM 5.5

  CVE-2026-53106 is a deadlock vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) local storage subsystem. The issue occurs when code running in NMI (Non-Maskable Interrupt) context attempts to delete local storage entries, which can cause the system to hang. The kernel developers have implemented a targeted fix that prevents deletion operations from proceeding when called from NMI context, returning an error instead of allowing the unsafe operation to proceed.

• CVE-2026-53107MEDIUM 5.5

  A flaw was found in how the Linux kernel's libertas WiFi driver handles USB data transmission. The driver was using a function that blocks (pauses) to prevent multiple transmission requests from overlapping, but this function can be called during interrupt handling—a special CPU context where blocking operations are forbidden. This mismatch can cause the system to sleep when it shouldn't, leading to kernel instability. The fix changes the approach: instead of forcefully stopping in-flight USB requests, the driver now checks whether a request is already pending and returns an error if one is, avoiding the problematic blocking call during interrupt handling.

• CVE-2026-53111MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the test_run functionality used to validate BPF programs. When certain BPF encapsulation helper functions attempt to access network device information during testing, they may crash the kernel if the test framework hasn't properly initialized the socket buffer's destination reference. This is a local denial-of-service issue that requires user-level access to trigger.

• CVE-2026-53113MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's WiFi driver (ath11k) that affects beacon template setup functions. When these functions encounter errors during parameter setup, they fail to properly release allocated memory for beacon templates. This can cause memory to accumulate over time, eventually degrading system performance or causing denial of service on affected devices, particularly WiFi access points and embedded systems running the vulnerable kernel code.

• CVE-2026-53114MEDIUM 5.5

  A flaw in the Linux kernel's AMD IBS (Instruction-Based Sampling) performance monitoring code allows a local attacker with limited privileges to trigger a fatal system crash. The vulnerability stems from the performance monitoring subsystem making an unsafe function call (perf_allow_kernel) directly from an NMI interrupt handler—a low-level, non-maskable interrupt context where such calls are dangerous. The fix relocates this permission check to event initialization time, caching the result so the NMI handler no longer needs to invoke the unsafe function.

• CVE-2026-53121MEDIUM 5.5

  A memory leak has been identified in the Linux kernel's AMD P-State driver, specifically in the CPU initialization code path. When the driver fails to configure power efficiency settings during CPU initialization, it deallocates resources improperly, leaving allocated memory orphaned in the system. Over time, repeated initialization failures could accumulate unused memory, degrading system stability and performance. This vulnerability requires local access to trigger and affects systems running vulnerable kernel versions with AMD P-State enabled.

• CVE-2026-53122MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's btrfs filesystem when the flushoncommit mount option is enabled. The issue occurs when a reflink operation (copy-on-write file cloning) interacts badly with the transaction commit process. Specifically, when copying inline file data to an offset beyond the current file size, a race condition can cause two kernel tasks to deadlock: one waiting on a file extent lock held by the other, while the other waits for a transaction to complete. This results in a system hang that can freeze processes and make the system unresponsive.

• CVE-2026-53123MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's RAID 5/6 reshape process. When direct I/O operations cross a reshape boundary, they wait for reshape progress while holding system references. If a user freezes the reshape and attempts to suspend the RAID array, the kernel can deadlock: the waiting I/O operations need reshape to continue, but the reshape thread is frozen, preventing the I/O from completing and suspension from finishing. This affects systems using md-raid arrays that perform live reshaping with concurrent I/O.

• CVE-2026-53124MEDIUM 5.5

  A vulnerability in the Linux kernel's ublk (userspace block device) subsystem can cause I/O cancellation to hang indefinitely when a userspace server process crashes during device recovery. The issue stems from how cancellation flags are managed: when a ublk server dies mid-recovery after fetching only some of the pending I/O operations, those fetched operations retain their cancellation flags and cannot be properly completed. This leaves I/O commands in a stuck state, potentially preventing graceful recovery or shutdown of the affected block device. The fix resets the cancellation flag for each I/O as it is fetched, rather than deferring this reset until all operations for a queue have been processed.

• CVE-2026-53125MEDIUM 5.5

  This is a Linux kernel bug that causes a deadlock when administrators try to clear an MD (multiple device) RAID array via the sysfs interface. When the "clear" command is issued, the kernel's internal locking mechanism gets confused about object ownership and tries to acquire the same lock twice simultaneously, causing the system to hang. The issue stems from improper reference counting—the kernel drops a reference to the array object too early, before properly releasing control of a protective mechanism that sysfs uses. This prevents legitimate array management operations and can make systems unresponsive.

• CVE-2026-53126MEDIUM 5.5

  A memory leak exists in the Linux kernel's block I/O (blk-cgroup) subsystem. When certain disk throttling operations fail internally, the kernel forgets to release a reference to the disk device, preventing it from being properly freed from memory. This causes a resource leak that accumulates over time as the system handles throttling requests, potentially leading to memory exhaustion or system instability. The bug was introduced when the kernel code was refactored to use a different internal data structure.

• CVE-2026-53127MEDIUM 5.5

  CVE-2026-53127 is a memory leak vulnerability in the Linux kernel's block device subsystem. When the kernel attempts to revalidate disk zones—a routine operation for certain storage hardware—and encounters an error, it fails to properly clean up allocated memory. This leaked memory accumulates over time, potentially causing system instability or service disruption on affected Linux systems.

• CVE-2026-53128MEDIUM 5.5

  A vulnerability in the Linux kernel's DRBD (Distributed Replicated Block Device) subsystem involves incorrect handling of RCU (Read-Copy-Update) synchronization primitives in the drbd_adm_dump_devices() function. The function calls rcu_read_unlock() without a corresponding prior call to rcu_read_lock(), creating an imbalance in RCU lock management. This can lead to kernel stability issues and potential denial of service. The defect was identified through automated static analysis using the Clang thread-safety checker.

• CVE-2026-53134MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem can leak uninitialized kernel memory to unprivileged local users. When the netfilter FIB module processes certain lookup failures or network interface checks, it fails to properly clear all memory locations it claims to initialize, leaving stale stack data accessible to userspace code. An attacker with local access could read sensitive kernel information through carefully crafted netfilter rules.

• CVE-2026-53135MEDIUM 5.5

  A flaw in the Linux kernel's AMD display driver debugfs interface can cause system crashes when users interact with a specific debug file. The vulnerability occurs in two ways: first, the code assumes a graphics connector is always attached to an active display pipeline, but this isn't true during hot-plug events or temporary disconnections—attempting to debug while in this state triggers a null pointer crash. Second, the same function blindly copies 36 bytes from user input regardless of how much data was actually provided, potentially reading beyond the user's buffer. Both issues require local access with standard user privileges to exploit.

• CVE-2026-53139MEDIUM 5.5

  A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) v3d driver allows local users to cause a denial of service by submitting graphics compute shader dispatch jobs with zero workgroup dimensions. When a compute shader is kicked off with zero counts in any dimension, the kernel should treat this as a no-op and skip execution; instead, the driver was allowing the submission through to hardware, which would misinterpret the zero as 65536—exceeding the valid maximum of 65535 and potentially causing system instability or hangs. This issue is particularly relevant for indirect compute shader dispatch jobs, where workgroup counts are only known at runtime from buffer contents.

• CVE-2026-53140MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) v3d driver. When processing compute shader dispatch (CSD) jobs with indirect workgroup counts, the driver fails to properly clean up memory mappings if any workgroup count is zero. This causes virtual address mappings to remain allocated, gradually consuming kernel memory. The issue is localized to a single code path and requires local access to exploit, making it a moderate risk to systems where untrusted local users can submit graphics workloads.

• CVE-2026-53141MEDIUM 5.5

  CVE-2026-53141 is a memory leak vulnerability in the Linux kernel's Direct Rendering Manager (DRM) v3d graphics driver. The vulnerability exists in the performance monitor reference counting logic, where the kernel fails to properly release memory references in three specific code paths. An unprivileged local user could trigger these memory leaks through GPU-related system calls, gradually exhausting kernel memory and causing system instability or denial of service. The vulnerability requires local access and does not enable privilege escalation or data theft.

• CVE-2026-53142MEDIUM 5.5

  The Linux kernel's xe graphics driver can crash when a system suspends or shuts down on certain Intel hardware where the display is disabled by hardware fuses. The driver keeps track of whether display hardware should be active, but fails to update this state when display is disabled after initial detection. This causes the driver to attempt operations on an uninitialized display configuration, resulting in a crash. The issue affects users with Intel GPUs where display functionality is hardware-disabled, particularly during power management transitions.

• CVE-2026-53144MEDIUM 5.5

  A flaw in the Linux kernel's AMD KFD (Kernel Fusion Driver) module can crash the system when a user-mode application provides invalid parameters to a debug trap function. Specifically, when an application requests to suspend GPU queues but supplies a non-zero queue count without a valid queue pointer, the kernel attempts to dereference a NULL pointer, triggering a panic. An unprivileged local user can exploit this to cause a denial of service.

• CVE-2026-53150MEDIUM 5.5

  A flaw in the Linux kernel's Thunderbolt subsystem allows a local attacker with standard user privileges to crash the system by supplying a specially crafted zero-length property entry. The vulnerability exists in the validation logic that checks incoming Thunderbolt XDomain properties; when a TEXT property has zero length, the code attempts to null-terminate a string at an invalid memory location, causing a buffer underflow. This is a denial-of-service issue affecting local system stability.

• CVE-2026-53152MEDIUM 5.5

  A NULL-pointer dereference vulnerability exists in the Linux kernel's Rockchip eMMC controller driver affecting very old SoC variants (RK2928, RK3066, RK3188). These legacy controllers lack support for high-speed UHS modes and traditionally had minimal driver initialization. A recent kernel commit added memory clock auto-gating logic that assumes driver private data exists, causing the old controllers to crash when they access uninitialized memory structures. The vulnerability requires local access and results in denial of service.

• CVE-2026-53154MEDIUM 5.5

  CVE-2026-53154 is a memory management bug in the Linux kernel's handling of huge pages (a performance optimization for large memory allocations). When the kernel tries to copy a huge page and that copy fails—for example, because the source page is corrupted (hwpoisoned)—it doesn't properly restore the memory reservation that was consumed for that operation. This leaves a task unable to use memory it had reserved, potentially causing it to crash with a SIGBUS signal later. The issue affects two specific code paths: copying huge pages during fork operations and when using the userfaultfd mechanism for memory fault handling.

• CVE-2026-53155MEDIUM 5.5

  A bug in the Linux kernel's memory management code corrupts the state of anonymous page tracking when device-private memory (used by GPUs and accelerators) is involved. The kernel incorrectly interprets memory flags when migrating pages between RAM and device memory, leading to assertions that crash the system. The issue surfaces in scenarios where a process with child processes (fork) migrates memory to and from device-private storage, particularly with large pages. A local user can trigger this by running specific memory-migration workloads.

• CVE-2026-53158MEDIUM 5.5

  CVE-2026-53158 is a NULL pointer dereference in the Linux kernel's fastrpc driver that can cause a system crash during boot on Qualcomm Snapdragon platforms. The vulnerability occurs when the DSP (Digital Signal Processor) sends a message to the kernel before the fastrpc driver finishes initializing. The kernel tries to access an uninitialized data structure, leading to a crash. This is a local availability issue requiring local access, affecting systems running vulnerable kernel versions on affected Qualcomm platforms.

• CVE-2026-53163MEDIUM 5.5

  CVE-2026-53163 is a null pointer dereference vulnerability in the Linux kernel's real-time mutex (rtmutex) locking mechanism. The flaw occurs when the kernel attempts to remove a waiter from a mutex queue without first verifying that the waiter is actually enqueued. This can happen during certain futex (fast userspace mutex) operations, particularly FUTEX_CMP_REQUEUE_PI calls. An unprivileged local user with limited access can trigger this condition, causing the kernel to crash and resulting in a denial of service. The vulnerability stems from incomplete deadlock detection logic that fails to properly initialize a waiter structure before the kernel later tries to clean it up.

• CVE-2026-53164MEDIUM 5.5

  A flaw in the Linux kernel's I/O memory management unit (IOMMU) and DMA handling can cause a system crash or hang when certain NVMe drives—particularly Thunderbolt-based SSDs—trigger software I/O translation lookaside buffer (SWIOTLB) operations with unaligned memory buffers. The kernel incorrectly attempts to map a zero-length memory region, fails, and then corrupts the mapping during error recovery. This is most commonly triggered by smartctl passthrough commands on affected Thunderbolt NVMe hardware.

• CVE-2026-53167MEDIUM 5.5

  A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows uninitialized memory to be accessed through the FUSE_NOTIFY_RETRIEVE operation. The issue arises because FUSE_NOTIFY_RETRIEVE can return data from page cache entries that haven't been properly initialized, potentially exposing sensitive information from kernel memory. The vulnerability only has meaningful security impact on systems that don't automatically zero-initialize memory allocations at boot time—most modern distributions enable this protection by default.

• CVE-2026-53168MEDIUM 5.5

  A vulnerability exists in the Linux kernel's FUSE (Filesystem in Userspace) subsystem where the pagecache notification operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE can be exploited to directly manipulate kernel-internal directory cache structures. These operations were intended for regular files only, but the kernel failed to properly validate request targets. An unprivileged local attacker could weaponize this to inject bogus data into directory caches, triggering kernel warnings and potentially causing denial of service or unexpected behavior. The fix restricts these operations to regular files and rejects misuse with an error code.

• CVE-2026-53169MEDIUM 5.5

  CVE-2026-53169 is a denial-of-service vulnerability in the Linux kernel's Ethos-U NPU driver. When userspace sends an unsupported NPU_OP_RESIZE command through the DRM interface, the driver's placeholder code unconditionally triggers a kernel warning. On systems configured to panic on warnings, any user with access to the DRM device can crash the kernel. The fix replaces the warning trigger with a proper error rejection, preventing both the spam and potential panic.

• CVE-2026-53177MEDIUM 5.5

  A vulnerability in the Linux kernel's Broadcom NetXtreme driver can cause a system crash when PCIe error recovery runs on a network interface card that has been administratively closed. The driver attempts to access memory structures that only exist when the NIC is active, leading to a NULL pointer dereference. An attacker with local access could trigger a PCIe error condition to crash the system or cause denial of service.

• CVE-2026-53181MEDIUM 5.5

  A flaw in the Linux kernel's virtual socket (vsock) implementation causes a resource leak when establishing connections between a guest and host via VMCI (VMware Communications Interface). When a server fails to complete the connection handshake—due to malformed packets, memory allocation issues, or event subscription problems—the kernel fails to properly clean up its internal connection tracking. Each failed attempt leaves a small piece of state behind, and after enough failures, the system silently rejects all new connection attempts. Restarting the affected process is the only recovery mechanism.

• CVE-2026-53190MEDIUM 5.5

  CVE-2026-53190 is a memory management bug in the Linux kernel's DRM (Direct Rendering Manager) virtio driver. When the driver attempts to wait on a DMA fence—a synchronization primitive used in graphics operations—it fails to properly release a reference to a fence object if an error occurs during the wait operation. This reference leak means memory is not freed as it should be, potentially leading to memory exhaustion if the condition is triggered repeatedly. The bug affects only the virtio GPU driver and requires local access to trigger.

• CVE-2026-53197MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's IPsec Traffic Flow Security (IPTFS) implementation. When the system destroys an IPTFS state object, it attempts to cancel two hardware timers while holding spinlocks that those same timers need to acquire. On multi-processor systems, this creates a circular wait condition where the main thread blocks waiting for timer callbacks to finish, while the timer callbacks block trying to acquire locks held by the main thread. The vulnerability was discovered through source code review rather than active exploitation.

• CVE-2026-53204MEDIUM 5.5

  The Linux kernel's Stratix10 RSU (Remote System Update) firmware driver contains a NULL pointer dereference vulnerability that can crash the system. When certain initialization messages time out during driver probe, the code incorrectly frees the communication channel but then tries to send additional messages on that same freed channel. The next kernel thread to run will crash when it attempts to access the freed channel structure. This is a local denial-of-service issue affecting systems with Intel Stratix10 hardware.

• CVE-2026-53206MEDIUM 5.5

  A flaw in the Linux kernel's Intel VPU (Video Processing Unit) driver fails to validate memory boundaries when loading firmware images. An attacker with local system access could craft a malicious firmware image with incorrect memory specifications, causing the kernel to attempt invalid memory allocation or access operations. This leads to a denial of service condition where the system or the affected driver becomes unavailable.

• CVE-2026-53207MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's memory failure handling code, specifically in how it manages hardware-poisoned huge pages. When two processes simultaneously call madvise(MADV_HWPOISON) on the same huge page while another thread unmaps the page, the kernel attempts to acquire the same spinlock twice, causing the system to hang. This is a kernel-level concurrency bug that requires local system access to trigger.

• CVE-2026-53208MEDIUM 5.5

  A flaw in the Linux kernel's Bluetooth BR/EDR (Basic Rate/Enhanced Data Rate) stack allows an unpaired attacker within radio range to trigger a denial-of-service condition. The vulnerability exists in the L2CAP (Logical Link Control and Adaptation Protocol) signaling layer, which fails to enforce the minimum packet size limit (MTUsig = 48 bytes) for Bluetooth signaling commands. An attacker can craft a single oversized signaling packet containing many ECHO_REQ (echo request) commands, forcing the target device to respond with numerous ECHO_RSP (echo response) frames, consuming bandwidth and processing resources without authentication.