2026 · Medium

Medium-severity vulnerabilities disclosed in 2026

Medium-rated CVEs published in 2026, with SEC.co remediation and prioritization guidance.

4010 published vulnerabilities · page 23 of 41

← All 2026 Known exploited (KEV)Critical High Medium All recent

CVE-2026-53210MEDIUM 5.5
CVE-2026-53210 is a memory leak vulnerability in the Linux kernel's TEE (Trusted Execution Environment) shared memory handler. When a user attempts to register shared memory with zero length via the TEE_IOC_SHM_REGISTER ioctl, the kernel allocates memory but fails to free it before exiting the error path, causing the allocated memory to leak. While the immediate impact is resource exhaustion rather than data exposure or privilege escalation, repeated triggering can degrade system stability on TEE-enabled systems.
CVE-2026-53211MEDIUM 5.5
A flaw in the Linux kernel's netfilter module causes uninitialized kernel memory to leak when certain network filtering rules access bridge device hardware addresses. When a netfilter rule requests the hardware address of an incoming interface on a bridge, the kernel writes only 6 bytes of the address into a register that is 8 bytes long, leaving 2 bytes of stale stack memory exposed. If a rule subsequently reads from that register, the uninitialized kernel data can be disclosed to a user-space application. The fix involves zeroing the full register before writing the hardware address.
CVE-2026-53213MEDIUM 5.5
A memory leak vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) video core (vc4) driver. The issue occurs when the krealloc() function is called to resize allocated memory without properly checking its return value before overwriting the original pointer. If krealloc() fails and returns NULL, the original memory block becomes unreachable and is leaked. An unprivileged local user could trigger this condition repeatedly, exhausting system memory and causing a denial of service.
CVE-2026-53214MEDIUM 5.5
A null pointer dereference vulnerability exists in the Linux kernel's IPv6 address configuration handling. When the kernel removes an IPv6 address, it attempts to clean up associated routing table entries. In certain conditions, it can reference a sentinel entry (a placeholder used internally) that lacks a valid routing table pointer, causing the kernel to crash. This affects local users with appropriate privileges and results in a denial-of-service condition. The vulnerability requires local access and appropriate user capabilities to trigger.
CVE-2026-53218MEDIUM 5.5
A flaw in the Linux kernel's netfilter subsystem allows a local, unprivileged user to trigger a condition where uninitialized memory is exposed through network packet filtering rules. When a specific flag (F_PRESENT) is used in netfilter extended header matching, the kernel incorrectly tracks which register storage areas have been written to, leaving portions of kernel stack memory accessible. This can lead to information disclosure or system instability.
CVE-2026-53219MEDIUM 5.5
A flaw in the Linux kernel's netfilter subsystem allows unprivileged local users to extract internal memory pointers used for performance counters. When retrieving firewall rule information, the kernel temporarily exposes the raw address of a per-CPU memory allocation before replacing it with sanitized data. If a user-space program causes a memory fault at precisely the right moment during this window, the raw pointer leaks out, potentially revealing kernel memory layout details that aid further exploitation.
CVE-2026-53220MEDIUM 5.5
A vulnerability in the Linux kernel's netfilter bridge module can cause a system crash when network packets are reinjected through the NFQUEUE mechanism after a bridge port has been removed or reassigned. The kernel fails to properly validate whether a bridge port still exists before attempting to process redirected traffic, leading to a null pointer dereference. While the immediate trigger requires local access and specific timing (removing a port between initial packet hook and reinject), the underlying validation gap represents a stability risk for systems relying on bridged network filtering.
CVE-2026-53222MEDIUM 5.5
A resource management issue exists in the Linux kernel's PTP (Precision Time Protocol) OCP driver. When the driver is unloaded, it frees pin resources before properly unregistering the PTP clock device. A recent kernel change causes the unregister process to reconfigure those already-freed pins, creating a use-after-free condition that can crash the system. The fix reorders operations so the clock is unregistered before pin resources are released, and ensures interrupt handlers are fully synchronized before cleanup.
CVE-2026-53226MEDIUM 5.5
A flaw in the Linux kernel's Rockchip GPIO driver causes memory and resource leaks when the driver is unloaded. Specifically, interrupt-handling structures allocated during driver initialization are not properly freed during removal. These orphaned structures remain registered globally and can be accessed by system callbacks after the hardware driver has already shut down, risking a crash. The fix requires explicitly cleaning up these structures before the driver fully unloads.
CVE-2026-53227MEDIUM 5.5
A memory management bug exists in the Linux kernel's Open vSwitch networking subsystem. When a network packet buffer fails to allocate during certain locking operations, the kernel attempts to free an invalid memory pointer, causing a crash. This vulnerability affects systems running vulnerable kernel versions, particularly in environments using Open vSwitch for virtualized networking.
CVE-2026-53231MEDIUM 5.5
A deadlock vulnerability exists in the Linux kernel's network PHY (physical layer) driver code. When the kernel uses its generic PHY driver (genphy) with SFP cage modules (small form-factor pluggable optical transceivers), an initialization sequence can cause the system to hang. The issue stems from improper handling of SFP bus setup under the RTNL (Real-Time NetLink) lock, which genphy acquires during probing but other PHY drivers do not. Systems attempting to initialize SFP cages through genphy will experience a complete deadlock, rendering network functionality unavailable until the system is restarted.
CVE-2026-53236MEDIUM 5.5
A vulnerability in the Linux kernel allows unprivileged users to attach Berkeley Packet Filter (cBPF) rules to TCP sockets in a way that could leak sensitive TCP connection information such as sequence and acknowledgment numbers. The fix restricts this socket option to only users with administrative network privileges (CAP_NET_ADMIN), preventing unprivileged applications from exploiting this side-channel to extract data about active TCP connections.
CVE-2026-53237MEDIUM 5.5
A NULL pointer dereference vulnerability exists in the Linux kernel's mvebu GPIO driver during system suspend and resume operations. The driver unconditionally calls PWM-related suspend and resume functions for all GPIO banks, but not all banks have PWM functionality. When a GPIO bank without PWM is processed, the code attempts to access memory through a NULL pointer, causing the system to crash. This vulnerability can be triggered by any user with local access to initiate a system suspend, making it a straightforward denial-of-service condition on affected systems.
CVE-2026-53238MEDIUM 5.5
A flaw in the Linux kernel's network labeling subsystem allows a local attacker with user-level privileges to trigger an out-of-bounds memory read. The vulnerability stems from incomplete validation when processing network configuration requests—specifically, the code checks the length of an IP address field but fails to validate the corresponding network mask field in the same way. An attacker can craft a malicious request that provides a properly-formatted address but a deliberately short mask, causing the kernel to read beyond the mask field's actual size and access uninitialized memory. This leads to a denial of service through a kernel crash.
CVE-2026-53241MEDIUM 5.5
The Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer contains a memory access vulnerability in its dummy port implementation. When the dummy sequencer port processes Unified MIDI Protocol (UMP) events, it copies event data into a temporary buffer that is sized for legacy events rather than the larger UMP event format. This causes the system to read beyond the buffer's actual size when forwarding the event to subscribers, potentially causing a kernel crash or information leak. The issue affects systems using ALSA's sequencer functionality with UMP event handling enabled.
CVE-2026-53243MEDIUM 5.5
A bug in the Linux kernel's rseq (restartable sequences) subsystem allows an uninitialized stack variable to be read and potentially leaked to userspace. The issue stems from how the C compiler evaluates the initialization of a local structure; it may read from the `ids.cpu_id` field before that field has been assigned a value, causing kernel memory to be exposed. This is a local privilege escalation risk affecting Linux systems where unprivileged users can trigger the vulnerable code path.
CVE-2026-53245MEDIUM 5.5
A parsing bug in the Linux kernel's Media Redundancy Protocol (MRP) implementation can cause the network stack to misinterpret protocol frames. The vulnerability occurs in how the kernel parses vector attribute fields within MRP Protocol Data Units (PDUs). When processing event sequences, the parser fails to correctly track its position in some cases—particularly when the number of events is a multiple of three, or when certain optional fields are present or absent. This can lead to the kernel applying spurious state changes to MRP applicant state machines or corrupting the offset used to parse subsequent protocol data, potentially triggering a denial of service.
CVE-2026-53249MEDIUM 5.5
CVE-2026-53249 addresses a privilege escalation and information disclosure risk in the Linux kernel related to IPv4 source routing options. The vulnerability stems from a lack of proper access controls on the LSRR (Loose Source and Record Route) and SSRR (Strict Source and Record Route) IP options, which allow unprivileged users to craft packets that traverse arbitrary network paths. An attacker with local access could exploit this to force traffic through controlled nodes, potentially revealing sensitive TCP sequence numbers and other protocol state information. The fix restricts these options to applications with CAP_NET_RAW capability, ensuring only privileged processes can use them.
CVE-2026-53251MEDIUM 5.5
A memory management flaw exists in the Linux kernel's Bluetooth ISO (Isochronous) connection handling. When the kernel routes Bluetooth ISO connections, it obtains a reference to a device object but fails to release it when the connection synchronization function exits, either normally or due to an error. This causes the reference count to remain elevated, potentially preventing the device from being properly cleaned up and leading to resource exhaustion over time.
CVE-2026-53252MEDIUM 5.5
A memory leak has been discovered in the Linux kernel's Bluetooth HCI subsystem. When Bluetooth device initialization fails early in the startup process, before the device is fully registered, a cleanup function is incorrectly skipped. This leaves behind unreleased memory from the SRCU (Sleepable RCU) synchronization mechanism, which accumulates per-CPU allocations that are never freed. While the leak itself doesn't directly compromise data confidentiality or integrity, repeated device failures can exhaust available memory and degrade system stability or cause denial of service.
CVE-2026-53257MEDIUM 5.5
A vulnerability in the Linux kernel's WiFi configuration system (cfg80211) can cause the system to crash when certain advanced WiFi capability settings are inconsistent. Specifically, if Extended HE (EHT) capability information is present but the corresponding operational data is missing, the kernel may fail. This is a local vulnerability requiring an authenticated user on the system to trigger.
CVE-2026-53258MEDIUM 5.5
A memory leak exists in the Linux kernel's WiFi scanning code that occurs when 6 GHz band scanning fails. When cfg80211_scan() encounters an error during split 6 GHz scanning, the kernel allocates memory for an internal scan request (rdev->int_scan_req) but fails to properly release it. This happens because the cleanup function checks for rdev->scan_req being populated before freeing resources, but in this error condition both pointers end up NULL, causing the allocated memory to never be released. The leak is triggered through normal WiFi scanning operations, typically initiated by user-space tools like wpa_supplicant.
CVE-2026-53261MEDIUM 5.5
A memory leak exists in the Linux kernel's devlink subsystem where relationship state is not properly released in certain failure scenarios. Specifically, when a device driver (particularly SubFunction or SF drivers) creates a nested devlink relationship to its parent before completing registration, and then fails during the probe process, the relationship reference is leaked because the normal cleanup path is bypassed. This affects only systems where drivers follow this specific initialization pattern and experience probe failures.
CVE-2026-53263MEDIUM 5.5
A memory handling error in the Linux kernel's 6LoWPAN implementation—a compression protocol for IPv6 traffic over low-power wireless networks—causes two problems: it corrupts compressed multicast addresses by overwriting a required identifier field, and it leaks uninitialized kernel memory over the network. The vulnerability is triggered during the compression of IPv6 multicast addresses and affects systems that use 6LoWPAN for IoT or embedded network communication.
CVE-2026-53269MEDIUM 5.5
The Linux kernel's netfilter synproxy feature can experience a race condition when multiple processes simultaneously attempt to register network hooks. This occurs because the infrastructure registers these hooks on-demand when users add iptables targets or nftables expressions concurrently, without proper synchronization. A fix has been implemented by introducing a mutex (mutual exclusion lock) to serialize access to the reference counting mechanism, preventing the race condition from occurring.
CVE-2026-53271MEDIUM 5.5
A flaw in the Linux kernel's ksmbd server allows a local user to crash the system by exploiting a race condition in how the server handles SMB (Samba/Windows file-sharing) connections. When a client disconnects while the server is processing certain file-locking notifications, the server can attempt to dereference a NULL pointer, triggering a kernel panic. An authenticated local user with minimal privileges can reliably trigger this denial-of-service condition.
CVE-2026-53274MEDIUM 5.5
A flaw in the Linux kernel's SMC (Shared Memory Communications) socket implementation allows a local attacker without special privileges to freeze kernel worker threads and trigger system instability. By exploiting how the kernel copies user-provided socket settings, an attacker can intentionally stall the copy operation—using specialized memory tricks—while holding a critical lock. This causes other kernel operations to hang indefinitely, eventually triggering watchdog alerts and system degradation. The fix relocates the vulnerable copy operation outside the locked section.
CVE-2026-53278MEDIUM 5.5
A null pointer dereference vulnerability exists in the Linux kernel's ARM MPAM (Memory Partitioning And Monitoring) subsystem. The issue occurs in the __destroy_component_cfg() function, which attempts to free memory structures without first checking whether those structures were actually allocated. If this function is called during system shutdown or component disable before initialization completes, the kernel attempts to access memory that doesn't exist, causing a crash. This is a local availability issue that requires prior system access to trigger.
CVE-2026-53279MEDIUM 5.5
A flaw in the Linux kernel's graphics driver for certain Intel graphics hardware can cause the system to hang during initialization when specific error conditions occur. The issue stems from improper cleanup of I2C adapters—hardware communication channels—when the LVDS display initialization fails. Rather than correctly tracking which adapters were created locally versus borrowed from elsewhere, the code attempts to shut down all adapters indiscriminately, leading to a deadlock.
CVE-2026-53280MEDIUM 5.5
A flaw in the Linux kernel's IOMMU (Input/Output Memory Management Unit) subsystem can cause the system to crash when PCI device reset operations are performed after a default domain allocation fails during initial device probe. The vulnerability stems from code attempting to re-attach a device to a domain without first checking whether the domain pointer is valid, leading to a null pointer dereference. This is a local issue requiring user-level privileges to trigger.
CVE-2026-53282MEDIUM 5.5
A flaw in the Linux kernel's kexec mechanism can cause the purgatory code (a small runtime environment used during kernel replacement) to crash when attempting to access memory it expects to find on the stack. This occurs specifically in non-jump kexec operations, where a recent kernel change removed stack setup that purgatory still depends on. The crash can disrupt system reboots or kernel updates that rely on kexec, though the impact is limited to local denial of service.
CVE-2026-53283MEDIUM 5.5
CVE-2026-53283 is a memory bounds-checking flaw in the Linux kernel's AMD IOMMU driver. When the system probes PCI devices during boot, the driver looks up which IOMMU manages each device using a lookup table indexed by device ID. For devices not described in the system's IOMMU configuration (IVRS), the driver reads past the end of the lookup table before verifying the device ID is valid. In recent kernel versions where the lookup table is tightly allocated, this out-of-bounds read retrieves adjacent kernel memory that gets incorrectly interpreted as a pointer, causing a crash. The vulnerability is triggered during system initialization and affects AMD-based virtualized environments where the IOMMU configuration is incomplete or restrictive.
CVE-2026-53285MEDIUM 5.5
CVE-2026-53285 is a kernel crash vulnerability in AMD's display driver (DCN32) on Linux systems. When the driver attempts to allocate memory for a phantom plane during bandwidth validation, it triggers a kernel panic because the memory allocation happens in a context where interrupts are disabled. This affects systems using AMD display hardware with the affected kernel versions. The crash is triggered locally by a privileged user and results in a denial of service.
CVE-2026-53287MEDIUM 5.5
A bug in the Linux kernel's audit logging system incorrectly records capability information when processes change their permissions. When a program modifies its inheritable capabilities—a mechanism used to control privilege escalation during program execution—the audit log incorrectly shows the effective capabilities instead of the inheritable ones. This means attackers could modify a process's inheritable capabilities in preparation for privilege escalation without leaving a clear trace in the audit trail, defeating the purpose of compliance and forensic monitoring. The flaw has existed since 2008.
CVE-2026-53288MEDIUM 5.5
A memory mapping issue in the Linux kernel's ARM64 architecture can cause the kernel's data segment to overflow into a reserved gap page during early boot initialization. This happens because the kernel's page table setup doesn't reserve enough space to handle the additional memory splits required when mapping certain kernel regions with different access permissions. The overflow can corrupt the early initialization stack, potentially causing the system to crash or behave unpredictably during boot or shortly thereafter.
CVE-2026-53289MEDIUM 5.5
A flaw in the Linux kernel's ice network driver can cause the system to crash when resetting all virtual functions (VFs) during firmware updates. The driver fails to properly check whether a critical rebuild operation succeeded, then proceeds to access memory structures that were never initialized, resulting in a NULL pointer dereference. The crash occurs in kernel code, affecting systems running affected kernel versions with ice-based network hardware.
CVE-2026-53291MEDIUM 5.5
The Linux kernel's Conexant audio driver does not properly validate error conditions when initializing jack detection during device probing. When the jack detection setup fails—for example, due to memory pressure—the driver ignores the error and continues as if initialization succeeded. This creates a window where the kernel may later crash when audio jack events occur or the driver tries to access uninitialized data structures. The issue arises because the developer did not use proper error-checking macros (IS_ERR/PTR_ERR) on the function return value.
CVE-2026-53292MEDIUM 5.5
A vulnerability in the Linux kernel's Phonet networking subsystem can crash a system when a local user sends data through a Phonet socket that has never been properly bound. The vulnerability exists because the kernel attempts to automatically bind an unbound socket, but when that binding fails, the code incorrectly assumes the socket was already bound to an address and crashes instead of handling the error gracefully. This is a local denial-of-service issue accessible to unprivileged users.
CVE-2026-53293MEDIUM 5.5
A concurrency control bug in the Linux kernel's AMD GPU driver can cause system crashes or hangs. The issue stems from incorrect lock ordering and improper memory allocation patterns that can deadlock the kernel when reading GPU memory-mapped registers. A local attacker with standard user privileges can trigger the denial of service without requiring special access or user interaction.
CVE-2026-53295MEDIUM 5.5
A vulnerability in the Linux kernel's mailbox subsystem can cause the system to crash (an 'OOPS') if a mailbox controller is initialized without a properly attached channel array. The issue stems from missing validation that checks whether the channel array exists before the code attempts to use it. Because mailbox controllers can start very early in the boot process, this crash may occur before logging systems are fully active, making it harder to diagnose. A fix adds a sanity check to gracefully fail if the channel array is missing, preventing the crash.
CVE-2026-53297MEDIUM 5.5
A flaw in the Linux kernel's Azure Ethernet driver (MANA) can cause the system to crash if device resume fails during power management operations. When the driver attempts to recover from a failed resume, it cleans up resources and sets internal pointers to NULL. However, if the device is later disconnected, the driver's removal code runs again without checking whether those pointers are already NULL, leading to a null pointer dereference and kernel panic. This is a reliability issue that affects system stability on affected Azure hardware.
CVE-2026-53298MEDIUM 5.5
A flaw in the Linux kernel's Airoha network driver can cause the system to crash when the driver fails to properly initialize network queues during startup. The problem occurs because the driver marks a queue as initialized before it has actually finished setting up all the necessary memory structures. If something goes wrong during this initialization, the cleanup code assumes the queue is fully ready and tries to access memory that doesn't exist, crashing the kernel. This is a local vulnerability that requires an attacker to already have user-level access to the system.
CVE-2026-53299MEDIUM 5.5
A flaw in the Linux kernel's Airoha network driver can cause the system to crash if network queue initialization fails. The vulnerability stems from premature initialization of a queue descriptor counter; when the driver attempts to clean up after a failed allocation, it tries to access memory that was never properly set up, triggering a crash. The fix moves the counter initialization to occur only after all critical setup steps succeed, ensuring cleanup only happens on fully initialized state.
CVE-2026-53301MEDIUM 5.5
A Linux kernel vulnerability in the Amlogic T7 reset driver can cause the system to crash when the reset subsystem is accessed. The issue stems from missing reset operations that lead to a null pointer dereference—essentially, the kernel tries to use a feature that hasn't been properly initialized. While the T7 reset functionality isn't currently active in most deployments, this defect becomes dangerous if the reset system is enabled or if future kernel updates activate this code path. The vulnerability requires local access to trigger, limiting its immediate blast radius, but the outcome is a denial of service that could bring down affected systems.
CVE-2026-53302MEDIUM 5.5
A flaw in the Linux kernel's EIP93 cryptographic hardware driver causes the system to crash when setting up HMAC encryption keys. The driver attempts to use a temporary encryption tool that doesn't exist because it's looking for the wrong type of algorithm—specifically excluding the async (asynchronous) algorithms that the driver actually provides. When this lookup fails, the encryption setup process leaves critical data uninitialized, and the next time the system tries to use that encryption setup, it crashes trying to access memory that was never properly configured. The vulnerability requires local access and authenticated user privileges to trigger.
CVE-2026-53304MEDIUM 5.5
A vulnerability in the Linux kernel's SCSI generic (sg) driver allows a local attacker with sufficient privileges to trigger a system hang by setting an invalid module parameter. The issue occurs when the def_reserved_size parameter is set to an out-of-range value (like -1) and then a SCSI device file is opened, causing the kernel to enter an infinite loop that freezes the CPU. This is a denial-of-service vulnerability requiring local access to exploit.
CVE-2026-53305MEDIUM 5.5
A flaw in the Linux kernel's USB Type-C PS8833x retimer driver can cause the system to crash when a user unbinds the device from its driver—for example, when attempting to reassign it to a virtualization framework. The crash occurs because the driver's cleanup routine tries to access driver data that was never properly initialized during device startup. This is a memory corruption issue (null pointer dereference) that affects local users with sufficient privileges.
CVE-2026-53306MEDIUM 5.5
A boundary error in the Linux kernel's hvc_iucv (IUCV hypervisor console) driver allows a local attacker to trigger an out-of-bounds memory access. The vulnerability stems from inconsistent bounds checking when managing virtual console devices. When the device counter reaches its maximum value of 8, the code can attempt to access an array element beyond its allocated range, potentially causing a kernel crash or memory corruption.
CVE-2026-53307MEDIUM 5.5
A flaw exists in the Linux kernel's pinctrl subsystem where device tree configuration parsing can crash the system. When a device tree specifies an empty 'pinmux' property, the kernel fails to validate this condition, leading to memory access errors. An attacker with local access could exploit this to trigger a denial-of-service condition by crafting a malicious device tree or pinctrl configuration.
CVE-2026-53308MEDIUM 5.5
A memory management flaw exists in the Linux kernel's max77705 power supply driver. The driver fails to properly clean up a work queue when the module is removed, causing a memory leak. Additionally, the order in which components are initialized and destroyed creates a race condition: if an interrupt fires after the work queue is destroyed but before the interrupt handler is cleaned up, the handler will attempt to schedule work on freed memory, potentially causing a system crash. The vulnerability requires local access and elevated privileges to trigger.
CVE-2026-53310MEDIUM 5.5
CVE-2026-53310 is a kernel memory access bug in Linux that affects Tegra-based systems (NVIDIA's ARM processors commonly used in mobile devices and embedded platforms). When the system encounters an error on one fabric (a subsystem interconnect), it incorrectly tries to read error information from a different fabric's memory location, causing a crash. The vulnerability requires local access to trigger and results in a denial of service—an attacker with a user account on the device could crash the kernel.
CVE-2026-53311MEDIUM 5.5
A vulnerability exists in the Linux kernel's FUSE (Filesystem in Userspace) subsystem where uninitialized memory is read when revalidating directory entries. Specifically, the `fuse_dentry_revalidate()` function accesses a timestamp field that may not have been set during dentry allocation, causing the kernel to use garbage values from memory. This can lead to denial of service through kernel crashes or undefined behavior. The issue is triggered during file open operations when the kernel creates new directory cache entries without properly initializing all fields.
CVE-2026-53312MEDIUM 5.5
A vulnerability in the Linux kernel's RISC-V IOMMU (input/output memory management unit) code can cause the system to enter an infinite loop during memory invalidation operations. The issue stems from improper overflow handling when processing page table invalidation requests. If a legitimately configured invalidation request specifies an end address at the maximum value the system can represent, the code fails to handle this edge case correctly, resulting in a denial of service condition where the kernel becomes unresponsive.
CVE-2026-53313MEDIUM 5.5
CVE-2026-53313 is a NULL pointer dereference vulnerability in the Linux kernel's AMD display driver (DRM/AMD). Two error-handling functions in the display management code attempt to log error messages without first verifying that a critical object is valid, risking a kernel crash. The vulnerability requires local access and occurs only in error paths, but when triggered, it can cause a denial of service. The fix involves reordering validation checks to ensure the object is safe before any code that depends on it runs.
CVE-2026-53314MEDIUM 5.5
A flaw in the Linux kernel's CPU hotplug subsystem can cause the system to report an error and potentially fail to properly shut down CPUs. The issue stems from improper callback ordering in the padata (parallel data) module—specifically, the CPU offline callback was registered in a section that forbids failure, but the callback itself can fail. Moving this callback to a section that permits failure resolves the condition and prevents false warnings during CPU power transitions.
CVE-2026-53315MEDIUM 5.5
A coding flaw in the Linux kernel's AMD Radeon driver can cause the system to crash if a function called ras_core_get_utc_second_timestamp() is invoked with an invalid or missing input. This function is responsible for recording timestamps when hardware reliability errors occur. The code checks whether the input is valid before using it, but then tries to log an error message using that same potentially invalid input, creating a window for a NULL pointer crash. The fix adds an upfront validation step to catch the problem earlier and exit gracefully.
CVE-2026-53316MEDIUM 5.5
A NULL pointer dereference vulnerability exists in the Linux kernel's AMD RAS (Reliability, Availability, and Serviceability) driver. When the ras_core object is NULL, the error handling path attempts to access ras_core->dev, causing a kernel panic. This can be triggered by a local attacker with standard user privileges, resulting in a denial of service that crashes the system or services dependent on the affected driver.
CVE-2026-53317MEDIUM 5.5
A flaw in the Linux kernel's MediaTek MT7921 WiFi driver causes the firmware to crash when a WiFi access point assigns a station ID number higher than 20. Under normal circumstances, this doesn't occur because most access point software starts numbering stations from 1 and enforces reasonable limits on the number of connected devices. However, with modified versions of access point software (like a customized variant of hostapd), stations can be assigned much higher ID numbers—such as starting at 65—which triggers a firmware crash. The issue affects only access point mode on MT7922 hardware; regular client mode connections are unaffected.
CVE-2026-53318MEDIUM 5.5
A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 chipsets can crash the system when certain network operations occur. The vulnerability stems from the driver checking a pointer after already using it, rather than checking first. An attacker with local system access could trigger this crash by performing specific wireless transmission activities, resulting in a denial of service. This is a kernel-level issue affecting machines that use MT7925 WiFi adapters.
CVE-2026-53319MEDIUM 5.5
CVE-2026-53319 is a Linux kernel issue in the block I/O writeback throttling (wbt) subsystem. The vulnerability stems from overly aggressive warning checks that trigger during normal, recoverable error conditions—specifically when memory allocation fails or when writeback throttling is already registered. These situations are expected and harmless, but the kernel's WARN_ON_ONCE macro was generating spurious warnings that could be weaponized by attackers or malicious tools to flood kernel logs. The fix replaces those warnings with silent error handling, allowing the system to gracefully degrade to operating without writeback throttling when initialization fails, which poses no functional risk.
CVE-2026-53320MEDIUM 5.5
A flaw in the Linux kernel's NILFS2 filesystem allows a local user with basic privileges to trigger a warning condition that can degrade system stability. The issue occurs when a corrupted request to mark blocks as dirty is processed with an invalid block number of zero, which should never occur in normal operations. The kernel fails to validate this impossible condition upfront, leading to unexpected behavior downstream. While not a direct path to privilege escalation or data theft, repeated triggering could impact system reliability.
CVE-2026-53321MEDIUM 5.5
A flaw in the Linux kernel's io_uring network polling subsystem allows a task to monopolize CPU time without yielding control back to the scheduler. The kernel's NAPI (Network API) polling mechanism, used by io_uring to efficiently check for network events, previously had no upper limit on how long it could poll continuously. This can cause the kernel to complain that a task is stuck, degrading system responsiveness and potentially causing watchdog timeouts. The fix caps the maximum polling duration at 10 milliseconds, which is still generous for performance but low enough to prevent scheduler complaints.
CVE-2026-53323MEDIUM 5.5
A deadlock vulnerability exists in the Linux kernel's Distributed Switch Architecture (DSA) subsystem, which manages network switching hardware. When certain network drivers (like fbnic) interact with DSA, calling ethtool diagnostic commands (such as `ethtool -i`) can freeze the kernel. The root cause is that DSA's code attempts to acquire a lock that is already held by the calling function, causing the system to wait indefinitely. This affects systems that combine modern network interface cards with DSA-managed switch ports.
CVE-2026-53324MEDIUM 5.5
A flaw in the Linux kernel's MANA network driver causes the system to crash when creating debugfs directories for network devices. The bug stems from unsafe naming logic: the code either uses a hardcoded name that multiple devices can share, or attempts to read device slot information that doesn't exist on virtual machines and some hardware configurations. When the kernel tries to create a debugfs directory with a duplicate or invalid name, the operation fails and triggers a crash. This affects systems using the MANA (Microsoft Azure Network Adapter) driver, particularly in virtualized environments like nested KVM or generic VFIO passthrough setups.
CVE-2026-53325MEDIUM 5.5
A vulnerability in the Linux kernel's AMD64 AGP (Accelerated Graphics Port) driver can cause a system crash when running in virtualized environments without physical AMD hardware. The driver's probe function fails to correctly detect when the required hardware is absent, allowing initialization to proceed and eventually triggering a crash when the driver tries to access non-existent hardware. This affects systems running vulnerable kernel versions in virtual machines or cloud environments.
CVE-2026-53326MEDIUM 5.5
A timing vulnerability in the Linux kernel's debug object pool management can cause the system to enter a deadlock during early boot on ARM64 systems running PREEMPT_RT (a real-time kernel variant). The issue occurs when hardware interrupts fire before the scheduler is fully initialized, allowing interrupt handlers to attempt memory allocation from the debug object pool. If that interrupt happens to hit code holding a lock needed for allocation, a circular lock dependency forms, freezing the system. The fix restricts pool allocation attempts from hard interrupt context during this early boot window.
CVE-2026-53327MEDIUM 5.5
A flaw in the Linux kernel's debug object handling can cause a system crash when the kernel tries to replenish its internal memory pool at an inopportune moment on real-time (RT) enabled systems. Specifically, the kernel's fill_pool() function attempts to acquire a real-time lock without checking whether the current task is already blocked waiting on another lock. Real-time kernels enforce strict priority inheritance rules that prohibit a task from blocking on multiple locks simultaneously, so this condition triggers an assertion failure and brings down the system. The issue is resolved by adding a check to prevent fill_pool() from executing when a task is already in the middle of such a priority-inheritance blocking chain.
CVE-2026-53328MEDIUM 5.5
A logic error in the Linux kernel's scheduler extension (sched_ext) subsystem triggers a spurious warning when the systemd user manager modifies control groups while a sched_ext scheduler is running. The warning fires during legitimate internal kernel operations and does not represent an exploitable security flaw—rather, it's a false alarm that can confuse operators and trigger monitoring alerts. The underlying issue stems from a mismatch between how the kernel tracks cgroup and css (control group subsystem) identities during task migration.
CVE-2026-53331MEDIUM 5.5
CVE-2026-53331 is a kernel-level deadlock vulnerability in the Linux kernel's Qualcomm SlimBus controller driver. The issue occurs when the system undergoes subsystem restart (SSR) or processor domain restart (PDR) events. During these restart procedures, the driver acquires a transmit lock to protect ongoing DMA transfers, but then attempts to acquire a separate controller lock in a different order than other code paths. This lock ordering inconsistency can cause the system to deadlock, where one thread holds the transmit lock while waiting for the controller lock that another thread already holds while waiting for the transmit lock. The vulnerability has a medium severity rating and could lead to system availability disruptions.
CVE-2026-53332MEDIUM 5.5
A race condition in the Linux kernel's Qualcomm SLIMbus NGD controller driver can cause the system to crash or fail to boot. The issue occurs when interrupt handlers or notification callbacks try to use driver data structures that haven't been fully initialized yet. This happens because the driver registers for hardware interrupts and system event notifications before completing its internal setup. Moving the registration of these callbacks to occur after full driver initialization eliminates the race condition.
CVE-2026-53333MEDIUM 5.5
A logic ordering issue in the Linux kernel's memory inspection code (mincore) causes it to incorrectly report certain special memory pages as missing or unavailable on systems built without swap support but with migration or memory failure detection enabled. When the kernel checks whether a page resides in memory, it prematurely rejects these special pages before properly identifying them, triggering false warnings and inaccurate reporting. The fix reorders the checks so special pages are recognized before the swap-related restrictions apply.
CVE-2026-53334MEDIUM 5.5
CVE-2026-53334 is a Linux kernel memory management bug that can cause a system crash when specific DAMON (Data Access Monitoring) memory optimization features attempt to initialize. The vulnerability occurs because the kernel fails to properly check whether a critical memory allocation succeeded before attempting to use it. If that allocation fails—a theoretically possible but rare event—the kernel tries to access a null pointer, crashing the system. This affects systems where DAMON_RECLAIM or DAMON_LRU_SORT features are enabled.
CVE-2026-53335MEDIUM 5.5
A flaw in the Linux kernel's DAMON (Data Access Monitoring) LRU sort module fails to properly handle memory allocation failures. When the system attempts to enable DAMON LRU sort but cannot allocate memory for its context object, the code proceeds as if the allocation succeeded and then attempts to dereference a NULL pointer, causing a kernel crash. An unprivileged local user can trigger this condition to denial-of-service a system.
CVE-2026-53336MEDIUM 5.5
A bug in the Linux kernel's EEPROM layout driver causes the system to hang indefinitely when it encounters certain vendor-specific EEPROM entries. The driver fails to skip unknown entry types properly, leaving it stuck in an infinite loop. This affects systems that use ONIE-compliant EEPROMs with non-standard vendor extensions. The fix is straightforward: ensure the driver continues scanning through EEPROM data even when it encounters unrecognized entry types.
CVE-2026-53337MEDIUM 5.5
A flaw in the Linux kernel's bonding driver allows a local attacker with network administration privileges to crash the system by attempting to manage a network bond with a non-existent slave interface. The kernel fails to validate that a network interface exists before attempting to log debug information about it, triggering a NULL pointer dereference that causes a kernel panic. The attack requires CAP_NET_ADMIN capability, limiting the blast radius to administrative users or containers with elevated privileges.
CVE-2026-53338MEDIUM 5.5
A flaw in the Linux kernel's Airoha network driver can cause the system to crash if a device tree configuration is missing or misconfigured. When the driver initializes certain hardware queues, it looks up a reserved memory region but fails to verify that the lookup succeeded before using the result. This gap allows a local attacker or misconfiguration to trigger a kernel panic, denying service to the system.
CVE-2026-53339MEDIUM 5.5
The Qualcomm CCI (Camera Control Interface) I2C controller driver in the Linux kernel has a bug that causes a crash when the driver is unloaded or the device is removed. The issue occurs because the driver attempts to wait for a completion signal from I2C masters that were never properly initialized. On systems where only one of the two available I2C masters is enabled, unloading the driver triggers a NULL pointer dereference, freezing or crashing the kernel. This is a local issue affecting systems with the vulnerable driver installed.
CVE-2026-53340MEDIUM 5.5
A flaw exists in the Linux kernel's i2c-imx driver where the order of operations during runtime power suspension can leave the I2C hardware in an inaccessible state. Specifically, the clock is disabled before the pinctrl (pin control) state is switched to sleep mode. If the pinctrl operation fails, the suspend is aborted but the clock remains off, causing a crash when the system tries to use the I2C hardware. The fix reorders these operations so the pinctrl state changes first, ensuring the clock stays enabled if something goes wrong.
CVE-2026-53342MEDIUM 5.5
A memory management bug in the Linux kernel's ARM64 architecture causes page-table cleanup to be incomplete when memory is hot-removed from a running system. When the kernel allocates page tables, it sets internal metadata and reserves memory counters; however, when those tables are freed during hot-removal operations, the cleanup steps were skipped. On systems with debug features enabled, this creates corrupt memory state warnings and can leak memory allocated for page-table locks. The fix ensures the cleanup process mirrors the allocation process.
CVE-2026-53343MEDIUM 5.5
A bug in the Linux kernel's ARM architecture code causes system crashes when two security features (KASAN memory debugging and virtual memory stack protection) are both enabled. The problem stems from an instruction that tries to read data from memory in a way that ARM processors don't allow—the instruction assumes the address is word-aligned when it may not be. When the kernel switches between processes, it crashes with an alignment exception before the system even fully boots. The fix is straightforward: use a byte-sized read instead of a word-sized read, since KASAN shadow memory tracks bytes anyway.
CVE-2026-53344MEDIUM 5.5
A vulnerability in the Linux kernel's mcp23s08 pinctrl driver causes a system crash during device initialization. The issue occurs because two required variables (mcp->dev and mcp->addr) are not set up before the driver attempts to communicate with the hardware. When the communication code runs and tries to use these uninitialized variables, the kernel encounters a NULL pointer reference and crashes. This affects systems using the MCP23S08 GPIO expander chip, particularly in embedded or IoT deployments. The crash happens only during driver probe and requires local system access to trigger.
CVE-2026-53345MEDIUM 5.5
CVE-2026-53345 is a memory leak vulnerability in the Linux kernel's KVM (Kernel-based Virtual Machine) hypervisor that affects systems running SEV-ES (Secure Encrypted Virtualization with Encrypted State) virtual machines. The issue occurs when KVM fails to properly clean up a writable page mapping during virtual machine destruction, particularly when userspace never completes operations after certain VM exits. This leaves memory incorrectly marked as dirty without proper cleanup, resulting in a resource leak. The vulnerability is triggered only during the shutdown sequence of affected VMs and does not allow remote exploitation or privilege escalation beyond the local user's existing permissions.
CVE-2026-53347MEDIUM 5.5
The virtio-gpu Linux kernel driver crashes when being unloaded if it was compiled without KMS (Kernel Mode Setting) support. During driver removal, the code attempts to shut down atomic graphics rendering components that were never initialized in the first place, causing the kernel to access invalid memory and crash. This is a local denial-of-service condition that affects systems running custom or minimal Linux kernel builds where virtio-gpu is present but KMS is disabled.
CVE-2026-53348MEDIUM 5.5
A NULL pointer dereference vulnerability exists in the Linux kernel's SDCA (SoundWire Device Class Audio) subsystem. When audio device registration fails partway through or during cleanup operations, the code attempts to unregister device pointers that have not been initialized, causing the kernel to crash. This occurs in systems using SoundWire audio, particularly when firmware loading fails. The vulnerability requires local access to trigger and impacts system availability.
CVE-2026-53349MEDIUM 5.5
A vulnerability in the Linux kernel's netfilter connection tracking system allows a dangling pointer to persist after NAT helper modules (such as H.323) are unloaded. When a pending network connection arrives after the module is removed, the kernel attempts to call code that no longer exists in memory, causing a crash. Triggering this requires the ability to remove kernel modules, limiting the threat to local attackers with elevated privileges, but the underlying issue—leaving stale pointers to freed code—represents a robustness problem that warrants timely patching.
CVE-2026-53350MEDIUM 5.5
A bug in the Linux kernel's audio subsystem can cause the system to crash when certain audio firmware controls are removed. The issue occurs because the code tries to clean up data associated with a control without first checking if that data actually exists. This can happen in specific scenarios where audio controls are set up differently than usual—either as system-level controls or when the audio driver has custom handling for controls. While the vulnerability requires local system access to trigger, the impact is a denial of service that could interrupt audio functionality or require a system restart.
CVE-2026-53351MEDIUM 5.5
CVE-2026-53351 is a medium-severity defect in the Linux kernel's RISC-V ptrace subsystem that causes a warning condition during core dump operations. When a process crashes and the kernel attempts to generate a core dump file, this bug triggers an abort condition in the ELF core dump handler. While not directly exploitable for unauthorized access, the vulnerability can cause denial of service by preventing core dumps from completing successfully, which disrupts both debugging operations and normal system crash handling.
CVE-2026-53353MEDIUM 5.5
CVE-2026-53353 is a medium-severity Linux kernel vulnerability in the HSR (High-availability Seamless Redundancy) networking subsystem. The issue stems from an erroneous assumption in the `hsr_addr_is_self()` function that triggers a kernel warning when the HSR interface is being torn down. The underlying problem is a race condition: the function expects the `self_node` structure to always exist while a device is visible to userspace, but device cleanup operations can clear this structure before the device is fully unregistered, creating a window where the warning fires. The fix removes the incorrect warning check rather than fundamentally altering HSR's operation. Only systems with HSR interfaces configured are affected.
CVE-2026-53655MEDIUM 5.5
Node-tar, a popular JavaScript tar archive library, contains a flaw in how it interprets PAX extended headers—a standard mechanism for adding metadata to tar entries. An attacker can craft a malicious tar file that causes node-tar to misalign its reading position within the archive. This misalignment makes node-tar extract a different set of files than other standard tar tools (GNU tar, libarchive, Python's tarfile module). The practical danger: if your organization uses one library to scan an archive for malware or secrets and a different library to actually extract it, an attacker can hide a malicious file from the scanner while ensuring it gets extracted anyway. This creates a gap in security tooling that could allow sensitive or harmful content to slip through undetected.
CVE-2026-53850MEDIUM 5.5
OpenClaw versions prior to 2026.4.25 contain a flaw in the focus command that bypasses authorization checks. An authenticated attacker can change focus state in ways the system administrator did not intend, potentially gaining unauthorized influence over gateway operations. The vulnerability requires valid credentials but does not require user interaction, making it a persistent risk in multi-tenant or shared-access deployments.
CVE-2026-53856MEDIUM 5.5
OpenClaw versions before 2026.4.24 have a file permissions problem in their configuration recovery feature. When the system restores its main configuration file (OpenClaw.json), it sets permissions too loosely, allowing other local users on shared systems to read it. Since the configuration file typically contains sensitive data like API keys, credentials, or internal settings, this gives unprivileged attackers a way to extract that information without needing special access.
CVE-2026-53870MEDIUM 5.5
Hermes Agent versions before 0.16.0 store sensitive application data—including conversation history and authentication secrets—in files that any local user on the system can read. When the application creates its database and configuration files, it sets overly permissive access controls, making this data available to anyone with local filesystem access. An attacker with a regular user account on the same machine can extract conversation records, tool execution payloads, system prompts, and cryptographic HMAC secrets without elevated privileges.
CVE-2026-54231MEDIUM 5.5
A local user can inject arbitrary content into system log files processed by the Automatic Bug Reporting Tool (ABRT) in libreport. When a program crashes, ABRT collects diagnostic information from the system journal. However, the scripts that gather this information don't properly filter out special characters that control log formatting. An attacker with local access can embed newline characters in their own log messages, which ABRT then reads and writes to its crash dump directory files without cleaning them up. This allows the attacker to manipulate files that root processes create, potentially altering important diagnostic records or injecting misleading content into crash reports.
CVE-2026-54530MEDIUM 5.5
pypdf, a widely-used open-source Python PDF library, contains a flaw that allows an attacker to create a specially crafted PDF file capable of causing an application to hang indefinitely. The vulnerability is triggered when the application attempts to extract text from the PDF in layout mode. This is a denial-of-service condition—the application becomes unresponsive but no data is stolen or corrupted. The flaw has been patched in version 6.13.0.
CVE-2026-54531MEDIUM 5.5
pypdf, a popular open-source Python PDF processing library, contains a flaw that allows an attacker to create a specially crafted PDF file that triggers an infinite loop when that file is merged with outlines (hierarchical document structure metadata) into a writer object. An attacker would need local access to the system and the ability to influence which PDFs are processed, making this a localized denial-of-service risk rather than a remote attack vector. The issue is resolved in pypdf version 6.13.0 and later.
CVE-2026-54557MEDIUM 5.5
mise is a popular tool for managing development dependencies like Node.js, Python, CMake, and Terraform across projects. A vulnerability in versions before 2026.6.1 allows an attacker to abuse the HTTP backend's symlink creation logic to place executable files or symlinks outside the intended mise installation directory. By crafting a malicious .tool-versions file in a repository, an attacker can trick mise into creating symlinks at arbitrary filesystem locations. If an attacker places a symlink in a directory that appears in a developer's PATH environment variable before legitimate tools, this could lead to execution of attacker-controlled code when developers run common commands.
CVE-2026-54651MEDIUM 5.5
pypdf, a widely-used Python library for PDF manipulation, contains a flaw that allows an attacker to craft a malicious PDF file capable of triggering an infinite loop when that file is merged with other PDFs in a writer operation. The vulnerability specifically occurs when processing PDFs containing threads or articles during a merge operation. An attacker with local access could exploit this to cause a denial of service by exhausting system resources and making applications using the library unresponsive. The issue has been patched in version 6.13.1.
CVE-2026-54679MEDIUM 5.5
jq, a widely-used command-line tool for processing JSON data, contains an integer overflow vulnerability in its string-handling code that only affects 32-bit systems. When processing specially crafted input, the vulnerable jvp_string_append function can miscalculate buffer sizes, leading to a buffer overrun that crashes the application. Version 1.8.2 and later contain the fix. This is primarily a local denial-of-service risk; the vulnerability does not compromise data confidentiality or integrity.
CVE-2026-54905MEDIUM 5.5
A flaw in concurrent-ruby's ReentrantReadWriteLock allows a thread to incorrectly obtain a write lock after repeatedly acquiring a read lock 32,768 times. The lock mechanism uses a single integer to track hold counts, and this specific reentry threshold causes the read count to overflow into a bit flag reserved for write locks. As a result, a thread can be granted write lock status without the library actually preventing other threads from holding read locks simultaneously, breaking the mutual exclusion guarantee that write locks are supposed to provide. This creates a race condition where concurrent read and write access can occur unsafely.
CVE-2026-55392MEDIUM 5.5
A vulnerability in NILFS utilities versions up to 2.3.0 allows attackers to crash system administration tools by providing specially crafted NILFS2 disk images. The flaw stems from insufficient validation of a critical superblock field before the tools perform mathematical operations on it. While no remote exploitation is possible, anyone with local access to a system or the ability to provide a malicious disk image can trigger a denial of service.