By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 23 of 86

• CVE-2026-52975HIGH 7.8

  A race condition exists in the Linux kernel's bonding driver (802.3ad mode) where two parts of the code access the same internal data structure without proper synchronization. One thread updates a pointer to an aggregator object while another thread reads it, potentially causing a crash or memory corruption. The vulnerability stems from missing RCU (Read-Copy-Update) synchronization primitives that the kernel uses to safely share data between concurrent operations.

• CVE-2026-52976HIGH 7.8

  CVE-2026-52976 is a use-after-free vulnerability in the Linux kernel's display and graphics subsystem (DRM/XE driver). The flaw exists in error handling code within the execution queue creation function. When certain resource allocation failures occur during queue setup, the kernel's cleanup logic fails to properly remove the queue from internal tracking structures before freeing memory. This leaves dangling pointers that can be dereferenced later, potentially allowing a local attacker with standard user privileges to corrupt kernel memory, escalate privileges, or crash the system.

• CVE-2026-52987HIGH 7.8

  A memory management bug in AMD GPU drivers for Linux allows a local attacker with user-level privileges to cause denial of service or potentially execute code with elevated privileges. The vulnerability stems from improper cleanup of resource management objects when handling GPU memory validation errors, leaving the system in an unstable state. An attacker would need local access to the affected Linux system but no special permissions beyond standard user rights.

• CVE-2026-52991HIGH 7.8

  CVE-2026-52991 is a use-after-free vulnerability in the Linux kernel's process scheduler and cgroup subsystem. The flaw occurs when a process tries to write pressure metrics to a cgroup control file at the same moment the cgroup is being deleted on another CPU. This timing collision can cause the kernel to access memory that has already been freed, potentially leading to system crashes or privilege escalation. The vulnerability requires local access and does not require special permissions, making it a meaningful threat in multi-tenant or shared-system environments.

• CVE-2026-52992HIGH 7.8

  A flaw in the Linux kernel's ADFS (Acorn Disc Filing System) driver allows a local attacker to write data outside the boundaries of an allocated memory buffer. The vulnerability occurs when the kernel encounters a specially crafted ADFS disc image with an invalid zone count of zero during filesystem mounting. Instead of rejecting this malformed image, the kernel allocates memory incorrectly and then writes beyond the allocated area, potentially leading to privilege escalation or system compromise on systems that mount untrusted ADFS filesystems.

• CVE-2026-53000HIGH 7.8

  A memory management flaw in the Linux kernel's netfilter NAT (Network Address Translation) subsystem could allow a local, unprivileged attacker to crash the system or potentially execute code with elevated privileges. The vulnerability stems from improper deferred cleanup of NAT hook structures when they are exposed to userspace inspection, creating a use-after-free condition. An attacker with local access and standard user permissions could trigger this by interacting with netfilter hook dump functionality, leading to kernel instability or privilege escalation.

• CVE-2026-53004HIGH 7.8

  A flaw in the Linux kernel's SCTP (Stream Control Transmission Protocol) networking code allows a local user to write data beyond the bounds of their own buffer in userspace memory. When an application queries authentication chunk information from an SCTP socket, the kernel fails to validate that the supplied buffer is large enough to hold both the header structure and the chunk list. This can cause the kernel to overwrite memory immediately following the caller's buffer with peer-controlled data, silently corrupting adjacent application data without triggering kernel memory corruption or obvious failures.

• CVE-2026-53005HIGH 7.8

  A memory safety flaw in the Linux kernel's AF_UNIX socket implementation can allow a local attacker with limited privileges to crash the system or potentially gain elevated access. The vulnerability arises from how the kernel handles socket redirects through SOCKMAP when file descriptors (critical system resource handles) are being transferred between sockets. The kernel's garbage collection mechanism fails to properly track these redirected sockets, leading to a use-after-free condition—accessing memory that has already been freed. This is particularly dangerous because it undermines the kernel's ability to safely manage file descriptor lifecycle.

• CVE-2026-53009HIGH 7.8

  A memory management bug exists in the Linux kernel's Intel ice network driver. When packet transmission setup fails, the driver frees a network buffer (skb) but leaves a reference to it marked as still valid. If the network interface is then shut down without sending another packet, the driver attempts to free the same buffer twice, causing a crash or memory corruption. This is a local privilege escalation vulnerability affecting systems running vulnerable Linux kernels with the ice driver.

• CVE-2026-53011HIGH 7.8

  A memory safety bug exists in the Linux kernel's traffic scheduling subsystem (taprio). When the scheduler switches from an administrative schedule to an operational one, the code frees the old schedule but continues to access it, leading to a use-after-free condition. An attacker with local access and basic privileges can trigger this flaw, potentially crashing the kernel or executing arbitrary code. The fix involves selecting the next scheduling entry from the new schedule immediately after the switch, rather than continuing to use stale pointers from the freed memory.

• CVE-2026-53016HIGH 7.8

  A buffer overflow vulnerability exists in the Linux kernel's AMD CCP (Cryptographic Coprocessor) crypto driver. When processing RFC3686 counter mode AES encryption requests via the AF_ALG socket interface, the driver incorrectly writes 16 bytes of data into an 8-byte buffer during IV (initialization vector) restoration. This causes memory corruption that a local, authenticated attacker can exploit to escalate privileges or crash the system. The issue stems from using a fixed block size constant instead of respecting the algorithm's actual IV size requirement.

• CVE-2026-53020HIGH 7.8

  A race condition exists in the Linux kernel's TLB (Translation Lookaside Buffer) synchronization logic. When the kernel synchronizes TLB entries across multiple processors, it traverses and modifies page table structures without consistently holding the necessary locks. This can allow a local attacker with user-level privileges to manipulate memory access patterns in ways that corrupt kernel data structures or gain unauthorized access to sensitive information. The vulnerability stems from incomplete synchronization mechanisms in the kernel's multi-core support for shared address spaces.

• CVE-2026-53024HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's Greybus raw character device driver. If a user writes data to the device after it has been disconnected, the kernel attempts to use memory that has already been freed, causing a kernel panic. The issue stems from improper synchronization between the write operation and the disconnect handler—disconnect destroys the connection object while a concurrent write may still be trying to access it.

• CVE-2026-53025HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's Greybus raw driver. When a raw bundle device is disconnected while an application still has its character device open, closing that file descriptor later triggers a memory access violation. The kernel attempts to release memory that has already been freed, causing a crash or panic. This is a local privilege escalation issue that requires an authenticated user to trigger.

• CVE-2026-53031HIGH 7.8

  A validation flaw exists in the Linux kernel's eBPF arena memory allocation function. When code requests memory allocation for a specific processor node, the kernel fails to verify that the node identifier is valid before processing the request. An attacker with local access can exploit this by supplying an out-of-bounds node ID, potentially causing memory corruption, information disclosure, or denial of service. The vulnerability requires local access and user-level privileges to trigger.

• CVE-2026-53033HIGH 7.8

  A race condition exists in the Linux kernel's BPF sockmap implementation for Unix domain sockets. When a BPF iterator program updates a sockmap while a socket connection is closing, a stale pointer can be dereferenced, leading to a use-after-free memory error. An attacker with local access and unprivileged user privileges can exploit this by crafting a BPF program that interacts with sockmap operations concurrent with socket state transitions, potentially causing a kernel crash or memory corruption.

• CVE-2026-53036HIGH 7.8

  A boundary-checking flaw in the Linux kernel's ARM64 BPF (Berkeley Packet Filter) JIT compiler allows certain branch displacement values to pass validation when they should be rejected. The bug causes the kernel to incorrectly encode branch instructions, flipping forward jumps into backward ones. A local, unprivileged process can trigger this during BPF program verification, leading to kernel memory corruption, privilege escalation, or denial of service.

• CVE-2026-53050HIGH 7.8

  A race condition exists in the Linux kernel's quota management system where two parallel operations can interfere with each other. When the quota deactivation process and the active quota scanner run simultaneously, the scanner may obtain a reference to a quota object that is being freed, potentially leading to use-after-free conditions. This vulnerability requires local access and valid user privileges to exploit, but once triggered can cause system crashes or data corruption under memory pressure.

• CVE-2026-53054HIGH 7.8

  A locking bug in the Linux kernel's direct rendering manager (DRM) for Qualcomm Adreno GPUs (msm driver) can allow a local attacker with user-level privileges to corrupt GPU memory or cause system instability. The vulnerability stems from incorrect argument handling during GPU virtual memory unmapping operations, which fails to properly serialize access to certain GPU buffer objects. While some buffer types benefit from shared locking mechanisms tied to the virtual machine itself, others bypass this protection entirely, leaving them vulnerable to race conditions when multiple processes interact with them simultaneously.

• CVE-2026-53059HIGH 7.8

  A flaw in the Linux kernel's device-mapper logging subsystem allows a local attacker with sufficient privileges to trigger a buffer overflow in kernel memory. When setting up mirrored storage volumes with very large capacity targets, an integer truncation causes the logging layer to miscalculate how much memory it needs. Subsequent operations then write data outside the allocated buffer, crashing the system or potentially allowing code execution. The vulnerability requires local access and elevated privileges to trigger.

• CVE-2026-53062HIGH 7.8

  A concurrency bug in the Linux kernel's device mapper cache policy allows multiple workers to simultaneously invalidate cache blocks without proper synchronization. When a cache is in passthrough mode, this missing lock protection creates a race condition that can corrupt internal counter data or cause use-after-free memory errors. An attacker with local access can trigger this vulnerability by writing to a cache device configured in passthrough mode with concurrent I/O operations, potentially leading to kernel crashes or memory corruption.

• CVE-2026-53067HIGH 7.8

  A memory management flaw in the Linux kernel's PCI endpoint MSI (Message Signaled Interrupt) module can allow a local attacker with low privileges to cause a denial of service or potentially gain elevated access. The vulnerability occurs during doorbell allocation when MSI vector requests fail—the kernel fails to properly clean up allocated memory, leaving stale pointers that can be dereferenced later or reallocated, leading to exploitable conditions. The issue also allows an attacker to repeatedly attempt allocation of the same resource without proper gating, potentially triggering the flaw multiple times.

• CVE-2026-53077HIGH 7.8

  CVE-2026-53077 is a Linux kernel vulnerability affecting the Reliable Datagram Sockets (RDS) protocol over InfiniBand (IB). The vulnerability stems from incomplete namespace isolation—RDS/IB operations were not properly restricted to the initial network namespace, allowing code running in non-initial namespaces to trigger malfunctioning behavior. An attacker with local access and unprivileged user privileges can exploit this to read, modify, or crash kernel memory and processes, compromising system integrity and availability.

• CVE-2026-53078HIGH 7.8

  A vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) subsystem allows unprivileged local users to leak kernel memory addresses and trigger out-of-bounds memory reads. The flaw exists in how the kernel handles certain BPF socket operations (sock_ops) when a program uses the same CPU register for both source and destination values. When specific network conditions occur—such as during TCP connection establishment with incomplete socket state—the kernel fails to properly clear the destination register, leaving sensitive kernel pointer data exposed. An attacker with local access can exploit this to bypass kernel address space layout randomization (ASLR) protections and read memory outside intended boundaries, potentially leading to privilege escalation or system compromise.

• CVE-2026-53081HIGH 7.8

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) verification engine allows two register states that should be considered incompatible to be incorrectly marked as equivalent. The verifier maintains a mapping of register identities to detect when optimization shortcuts would be unsafe. When comparing registers that both contain offset constants (BPF_ADD_CONST), the verifier was creating separate mapping entries without checking if their underlying identities conflicted. This breaks the consistency guarantee that prevents unsafe state pruning, potentially allowing a crafted eBPF program to bypass security checks that would normally catch logical inconsistencies.

• CVE-2026-53085HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's BPF task_vma iterator. When BPF programs iterate through a task's virtual memory regions, the code reads the task's memory descriptor (mm_struct) without properly securing a reference to it. If the task exits while the iteration is happening, the memory descriptor can be freed, causing the BPF code to access freed memory. This affects systems running vulnerable kernel versions where unprivileged users or privileged BPF programs can trigger the flaw through specially crafted BPF programs that use open-coded task_vma iteration.

• CVE-2026-53089HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem when querying information about offloaded maps or programs. The vulnerability occurs during network namespace destruction: when code attempts to safely reference a network namespace associated with an offloaded BPF resource, it may inadvertently try to increment a reference counter that has already reached zero. This can lead to memory corruption or denial of service. The fix involves checking whether the namespace is still alive before attempting to reference it, and gracefully returning an error if the namespace is being torn down.

• CVE-2026-53090HIGH 7.8

  A flaw exists in the Linux kernel's Berkeley Packet Filter (BPF) subsystem where the verifier fails to properly validate the error path when packet data load instructions (ld_abs and ld_ind) fail in subprograms. These instructions can fail and return zero, causing the program to exit abnormally. The kernel's code generator handles this failure scenario, but the verifier—which is responsible for ensuring BPF programs are safe before execution—does not simulate what happens when the load fails. This means unsafe programs could pass verification and potentially execute with unintended behavior, allowing a local attacker with appropriate privileges to gain elevated capabilities on the system.

• CVE-2026-53092HIGH 7.8

  A flaw in the Linux kernel's eBPF verifier allows incorrect tracking of register value changes when the same register is used as both source and destination in arithmetic operations. The verifier modifies the destination register first, then reads the modified value back when it should use the original value. This causes the verifier to compute and propagate wrong assumptions about register constraints to linked registers, creating a gap between what the verifier believes is safe and what actually happens at runtime. A local user can exploit this mismatch to bypass security checks.

• CVE-2026-53094HIGH 7.8

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem causes a use-after-free vulnerability when a device-bound XDP program is hardened through constant blinding during JIT compilation. When the kernel optimizes constant values in these programs by cloning and replacing them, a stale pointer in the offload structure is not updated. This stale pointer later triggers a page fault and kernel crash when the network namespace is torn down. The issue is specific to dev-bound-only programs, which combine the normal JIT path with an offload structure that must remain synchronized.

• CVE-2026-53096HIGH 7.8

  A critical synchronization bug exists in the Linux kernel's eBPF network device map redirection code. When the kernel processes network packets through eBPF programs that redirect traffic across multiple devices, it uses an unsafe iteration method on hash-based device maps. This allows a reader thread to see partially-initialized data structures when concurrent writer threads are updating the map, potentially leading to memory corruption or system crashes. The vulnerability affects systems using eBPF-based traffic steering, particularly on ARM64 and PowerPC architectures where memory ordering guarantees are weaker.

• CVE-2026-53097HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's MT7996 Wi-Fi driver code. When the wireless adapter is being removed from the system, a background worker thread may still be trying to access data structures that have already been freed, causing a crash or potential code execution. The issue stems from improper synchronization between the device removal process and a pending diagnostic dump operation.

• CVE-2026-53098HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's MediaTek WiFi driver (mt76) for the MT7915 chipset. When a device is removed, the driver can attempt to access memory that has already been freed, causing a crash or potential security issue. This happens because cleanup code doesn't properly wait for background work tasks to finish before releasing the data those tasks might still be using. The vulnerability requires local access to trigger and affects systems with MT7915 WiFi hardware running vulnerable kernel versions.

• CVE-2026-53109HIGH 7.8

  CVE-2026-53109 is a memory management bug in the Linux kernel's PowerPC architecture code that can cause a system crash or data corruption when page table fragments are freed. The vulnerability occurs in a specific scenario involving deferred page table cleanup (introduced in a recent kernel patch series) combined with process exit. When certain conditions align—particularly when cached page table fragments retain references but are freed during program termination—the kernel incorrectly manages the active flag on memory pages, leading to a kernel panic with "Bad page state" errors. This is a local vulnerability requiring user-level code execution on an affected system.

• CVE-2026-53110HIGH 7.8

  A critical flaw exists in how the Linux kernel's BPF (Berkeley Packet Filter) just-in-time compiler handles function return values and arguments on IBM System z (s390x) processor architecture. The vulnerability stems from incomplete implementation of the s390x calling convention—specifically, the JIT compiler fails to properly zero-extend unsigned values in certain contexts, only implementing sign-extension. This mismatch between what the ABI requires and what the JIT delivers can lead to data corruption, privilege escalation, or system compromise when BPF programs interact with kernel functions. While exploitation requires local access, the impact is severe.

• CVE-2026-53112HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's rtlwifi WiFi driver for PCI devices. When a WiFi card is removed or initialization fails, a background task (irq_prepare_bcn_tasklet) may continue running and attempt to access memory that has already been freed, potentially causing a crash or allowing a local attacker with user privileges to corrupt kernel memory or escalate privileges.

• CVE-2026-53115HIGH 7.8

  A vulnerability in the Linux kernel's fsl-mc (Freescale Management Complex) bus driver allows local attackers to trigger a use-after-free condition when the kernel probes drivers. The issue stems from improper synchronization: the driver override field is accessed without holding the necessary device lock during the driver attachment process, creating a race condition that could lead to privilege escalation or system compromise on affected systems.

• CVE-2026-53116HIGH 7.8

  A race condition in the Linux kernel's AP (Adjunct Processor) bus driver can lead to a use-after-free memory vulnerability when AP security masks are updated concurrently with driver override settings. An attacker with local access could exploit this to crash the kernel or potentially execute code, though practical exploitation requires specific timing and local system access. The issue stems from insufficient locking around shared data structures, allowing one operation to free memory while another is still reading it.

• CVE-2026-53117HIGH 7.8

  A use-after-free (UAF) vulnerability exists in the Linux kernel's s390 channel I/O subsystem. The vulnerability occurs when the kernel probes a driver and accesses the driver_override field without holding the necessary device lock, creating a race condition where the field could be accessed after being freed. This allows a local attacker with standard user privileges to corrupt memory, potentially leading to privilege escalation or system crash.

• CVE-2026-53118HIGH 7.8

  A race condition exists in the Linux kernel's vdpa (vhost data path acceleration) subsystem where the driver override mechanism can be accessed without proper locking. When the kernel attempts to attach a driver to a device, it calls the bus match function without holding the device lock. If another process simultaneously modifies the driver_override field, this can lead to a use-after-free (UAF) condition, where freed memory is incorrectly accessed. The fix involves adopting the kernel's generic driver_override infrastructure, which handles locking internally to prevent concurrent access issues.

• CVE-2026-53119HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's WMI (Windows Management Instrumentation) platform driver. The issue occurs when the kernel probes a driver and accesses the driver_override field without proper locking, allowing a local attacker with standard user privileges to cause memory corruption. An attacker could exploit this to read sensitive memory, modify kernel data structures, or crash the system.

• CVE-2026-53120HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's PCI driver handling code. When the kernel attempts to attach a driver to a PCI device, it accesses configuration data (driver_override) without proper synchronization. An attacker with local access could potentially exploit this race condition to read sensitive kernel memory, modify kernel data, or execute code with kernel privileges. The vulnerability affects Linux kernel versions that use the affected PCI probe path.

• CVE-2026-53129HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's memory cache management system. When a filesystem (ext2, ext4, or ocfs2) is unmounted, the cache cleanup code frees memory before ensuring that a background shrink worker thread has stopped running. If the worker thread is still active, it will attempt to access the freed memory, causing a crash or potential code execution. This affects only privileged users who can unmount filesystems, limiting the immediate risk surface.

• CVE-2026-53130HIGH 7.8

  A vulnerability in the Linux kernel's OMFS (OMFS filesystem) implementation allows a local attacker to corrupt kernel memory by mounting a specially crafted filesystem image. The kernel fails to validate a critical filesystem parameter (the system block size) during mount, allowing it to be set smaller than a required minimum. This triggers an integer underflow that causes the kernel to zero out approximately 4 GB of memory, potentially overwriting sensitive kernel data structures. An attacker with local filesystem access can exploit this to cause denial of service or potentially execute code with kernel privileges.

• CVE-2026-53133HIGH 7.8

  A memory addressing bug in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem can cause incorrect DMA addresses to be calculated when handling large memory blocks. The vulnerability occurs during the reassembly of scattered memory pages into contiguous blocks for I/O operations, particularly when block sizes exceed 4 GB. An unprivileged local user with the ability to perform RDMA operations can potentially read or modify sensitive memory regions or trigger a denial of service.

• CVE-2026-53136HIGH 7.8

  A vulnerability exists in the Linux kernel's AMD display driver where untrusted values from a system's BIOS firmware are used directly to control memory operations during driver initialization. An attacker with local access who can modify the BIOS firmware can specify invalid register counts that cause the driver to write data beyond allocated memory boundaries, potentially crashing the system or executing code with kernel privileges.

• CVE-2026-53137HIGH 7.8

  A vulnerability exists in the Linux kernel's AMD display driver that could allow a malicious HDMI repeater device to write data beyond the intended buffer boundaries on a system. When the system authenticates an HDMI repeater during HDCP 2.x security handshakes, it reads a message size value from the repeater without validating it against the actual buffer capacity. A malicious or compromised repeater could advertise an oversized message, triggering an out-of-bounds write and potentially allowing the attacker to corrupt memory or execute code with the privileges of the affected process.

• CVE-2026-53143HIGH 7.8

  A memory handling error in the Linux kernel's AMD GPU driver (amdkfd) causes a 1536-byte buffer overflow when saving or restoring GPU compute queue state on AMD Navi3x graphics processors. The driver incorrectly uses a larger data structure (2048 bytes) to read from or write to a smaller GPU memory region (512 bytes), allowing unauthorized access to adjacent memory and potential data corruption. This affects systems using AMD RDNA3 GPUs with the kernel's checkpoint/restore functionality (commonly used in container and virtual machine operations).

• CVE-2026-53145HIGH 7.8

  CVE-2026-53145 is a race condition vulnerability in the Linux kernel's DRM (Direct Rendering Manager) subsystem, specifically in the gem_change_handle ioctl. The vulnerability stems from multiple failed attempts to fix an underlying synchronization issue between the gem_close and gem_change_handle operations. A local attacker with standard user privileges can exploit this flaw to trigger a privilege escalation or cause denial of service. The kernel development team has disabled the affected ioctl pending a comprehensive fix and proper test coverage to prevent recurrence.

• CVE-2026-53148HIGH 7.8

  A flaw in the Linux kernel's Thunderbolt XDomain communication handler allows a malicious peer device to trigger a buffer overflow. The vulnerable function copies data based on a length value from an incoming packet without verifying it matches the actual allocated memory, enabling an attacker with local access to overwrite kernel memory and potentially gain elevated privileges.

• CVE-2026-53153HIGH 7.8

  CVE-2026-53153 is a race condition in the Linux kernel's memory management subsystem that can corrupt data structures in a process's memory. The vulnerability exists in how the kernel handles the cleanup of list management structures when a memory control group (memcg) is being terminated. When a memcg is shutting down, the kernel must transfer its list entries to the parent memcg before removing references to the old structure. Due to a timing gap between these operations, a concurrent thread may modify list pointers under the wrong lock, causing adjacent memory items to corrupt each other. A local attacker with unprivileged access can trigger this race condition to achieve privilege escalation or system instability.

• CVE-2026-53156HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's NVMEM (non-volatile memory) subsystem. The issue occurs in error handling code paths where the kernel prematurely frees memory associated with an NVMEM device, then continues to access that same freed memory. This can lead to unpredictable behavior, including information disclosure, data corruption, or system crashes. The vulnerability requires local access and valid user privileges to trigger.

• CVE-2026-53157HIGH 7.8

  A memory safety flaw exists in the Linux kernel's Phonet networking subsystem. When a Phonet device is destroyed, the kernel removes it from a shared list but immediately frees the memory. Other parts of the kernel can still be accessing that same memory after it's freed, causing a crash or potential code execution. The fix ensures the kernel waits for all readers to finish before reclaiming the memory.

• CVE-2026-53160HIGH 7.8

  A race condition in the Linux kernel's fastrpc driver allows a local attacker to trigger a use-after-free vulnerability. The vulnerability occurs when one code path looks up a map object, releases its lock, and then tries to acquire a reference to that object—but a concurrent operation can delete the object in the interim, leaving the first operation with a dangling pointer. An attacker with local system access can exploit this timing gap to cause a kernel crash or potentially execute code with kernel privileges.

• CVE-2026-53161HIGH 7.8

  CVE-2026-53161 is a use-after-free vulnerability in the Linux kernel's fastrpc (fast RPC) driver, a Qualcomm component that handles communication with digital signal processors (DSPs). The flaw occurs when a user closes their connection to the driver while the system is still processing responses from the DSP. The driver can attempt to access data structures that have already been freed, potentially leading to kernel crashes or privilege escalation. This vulnerability requires local access and user-level privileges to trigger, making it primarily a concern for multi-user systems or those where untrusted local users have accounts.

• CVE-2026-53162HIGH 7.8

  A vulnerability exists in the Linux kernel's memory control group (memcg) subsystem where random number generation used during memory pressure handling is unsafe in certain CPU contexts. When the kernel needs to free cached memory pages during high memory demand, it calls get_random_u32_below() to randomly select which memory cgroup should have its cache drained. However, this random function is not safe to use in NMI (non-maskable interrupt) handlers, which can fire at any time on a CPU. If an NMI occurs while the random number generator is mid-operation, it can corrupt the internal state used by that subsystem, potentially leading to unpredictable kernel behavior. The fix replaces random selection with a simple round-robin algorithm that cycles through memory cgroups in order, eliminating the need for unsafe random calls.

• CVE-2026-53172HIGH 7.8

  A flaw in the Linux kernel's NPU (Neural Processing Unit) command stream parser allows a local attacker to corrupt kernel memory by sending specially crafted input. The vulnerability exists because the code incorrectly validates region indices for input feature map (IFM) regions, permitting values up to 127 when only 0–7 are valid. This mismatch enables an attacker to write data far beyond the intended memory buffer, potentially causing system instability, privilege escalation, or information disclosure.

• CVE-2026-53173HIGH 7.8

  A memory safety flaw in the Linux kernel's Arm Ethos-U NPU driver allows a local attacker to write data beyond the boundaries of an allocated buffer. The vulnerability exists in the command stream parsing loop, which fails to validate the buffer bounds after incrementing an index for 64-bit command words. An attacker with local access can craft a malicious command buffer via ioctl to trigger an out-of-bounds heap write, potentially corrupting kernel memory or escalating privileges.

• CVE-2026-53174HIGH 7.8

  A logic error in the Linux kernel's overlay filesystem (ovl) implementation can cause the readdir operation to return a spurious error code even when the underlying cache retrieval succeeds. The bug occurs in ovl_iterate_merged(), which incorrectly stores a truncated pointer value as an error status before validating whether the pointer actually represents an error. This affects nested overlay filesystem scenarios, such as reading directories from an overlay mounted on top of another overlay. The flaw allows unprivileged local users to trigger failed directory operations that should have succeeded, potentially disrupting application behavior that depends on reliable directory listing.

• CVE-2026-53182HIGH 7.8

  A memory handling vulnerability exists in the Linux kernel's Wi-Fi configuration parser. The code that processes Wi-Fi network information (Reduced Neighbor Reports, or RNR) fails to properly validate when it has parsed too many list items, potentially allowing an oversized list to be passed to memory allocation routines. This occurs because the parser uses an 8-bit counter that maxes out at 255, but doesn't reject input once that limit is reached. A local attacker with appropriate privileges could craft malicious Wi-Fi configuration data to trigger memory corruption or gain elevated system privileges.

• CVE-2026-53185HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's zram compression layer. When zram writes data using a backing device (writeback mode), a race condition causes the kernel to free a memory page while an asynchronous read operation is still writing to it. This can lead to memory corruption, denial of service, or local privilege escalation by unprivileged users.

• CVE-2026-53189HIGH 7.8

  A flaw in the Linux kernel's huge page memory management can cause the system to read freed memory when splitting large memory pages. The vulnerability occurs because the kernel updates memory counters after releasing a reference to freed memory, rather than before. This timing issue allows access to corrupted or stale data, potentially leading to system crashes or privilege escalation by local attackers. The fix is straightforward: reorder the operations so the counter is updated before releasing the memory reference.

• CVE-2026-53191HIGH 7.8

  A flaw exists in how the Linux kernel handles certain network receive operations when they need to retry internally. During these retries, the kernel fails to properly preserve a flag (IORING_CQE_F_BUF_MORE) that tells user applications whether a buffer is being reused. When this flag is lost, applications can incorrectly assume a buffer is available for reuse when it actually still contains data the kernel is using, leading to memory corruption and potential system instability.

• CVE-2026-53192HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's ALSA (Advanced Linux Sound Architecture) timer subsystem. When a userspace timer is closed and freed, other running tasks may still hold references to timer instances associated with that timer object. Under concurrent access conditions, the SNDRV_TIMER_IOCTL_PARAMS ioctl call lacks proper synchronization, allowing it to access freed memory. An attacker with local user privileges can trigger this race condition to crash the system or potentially execute code with elevated privileges. The fix adds mutex protection to the vulnerable ioctl handler.

• CVE-2026-53193HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's ALSA timer subsystem. When a timer object is destroyed while slave timer instances are still active and linked to a master instance, those slave instances may retain pointers to freed memory. This can occur in typical scenarios where one application creates and destroys a timer (particularly userspace-driven timers via CONFIG_SND_UTIMER) while other applications continue to access it. The kernel fix ensures that all timer instances are properly closed and detached before cleanup, preventing orphaned references to freed memory.

• CVE-2026-53194HIGH 7.8

  A buffer overflow vulnerability exists in the Linux kernel's USB serial driver for Kleiner-Leibhaftig (KL5) devices. When writing data to a connected KL5 USB serial device, the kernel fails to account for a two-byte header that must fit within the output buffer, allowing user-space applications to trigger an out-of-bounds memory write. A local attacker with write access to a tty interface can crash the system or potentially execute arbitrary code in kernel memory.

• CVE-2026-53195HIGH 7.8

  A vulnerability exists in how Linux handles USB serial device firmware files. When processing firmware for certain USB-to-serial adapters (specifically Xsens motion trackers using TI chips), the kernel fails to properly validate the size of data being copied into a fixed-size buffer. An attacker with local access could supply a malicious firmware file that triggers a heap buffer overflow, potentially allowing code execution or system crash.

• CVE-2026-53201HIGH 7.8

  A vulnerability in the Linux kernel's Intel Xe graphics driver allows a local attacker with user privileges to gain elevated access or crash the system. The issue stems from an optimization that was intended to improve suspend performance by skipping GPU queue scheduling when idle. However, this shortcut prevents the GPU from performing critical memory translation buffer (TLB) flushes during context switches. When user memory pointers are invalidated, the missed TLB flush can leave stale memory mappings accessible, potentially allowing an attacker to read sensitive data, modify memory, or trigger a denial of service. The vulnerability specifically affects systems using the Xe driver's LR (Long-Running) or preempt-fence virtual machine mode.

• CVE-2026-53202HIGH 7.8

  A vulnerability in the Linux kernel's Intel VPU (accel/ivpu) driver can cause a stack buffer overflow when processing firmware-supplied data. The issue stems from a signed/unsigned integer mismatch: the driver receives a data size value from firmware (unsigned), but casts it to a signed integer before using it in a min operation. If the firmware provides a large value (≥2GB), the signed cast causes it to become negative, which can lead to incorrect buffer size calculations and oversized memory copies that overflow the stack. An attacker with local access and appropriate privileges could exploit this to cause a kernel crash or potentially execute arbitrary code.

• CVE-2026-53209HIGH 7.8

  A vulnerability exists in the Linux kernel's Bluetooth advertising subsystem where a buffer overflow can occur when the system attempts to prepend Broadcast Announcement service data to an already-full advertising payload. The kernel fails to validate that the combined data will fit within available memory before attempting the operation, potentially allowing a local user with sufficient privileges to trigger a crash or execute code with elevated permissions. The fix adds a validation check to reject oversized combinations before the unsafe copy operation occurs.

• CVE-2026-53212HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's netfilter tunnel implementation. When the tunnel object is destroyed, the code improperly frees memory without accounting for packets that may still hold references to that memory. If packets queued in network discipline systems (like netem) eventually attempt to release their references, they operate on already-freed memory, causing a kernel crash or potential code execution. The fix replaces an unsafe free operation with proper reference-counting semantics.

• CVE-2026-53233HIGH 7.8

  A double-free memory corruption flaw exists in the Linux kernel's network device management layer. When the kernel attempts to send a reply message via the generic netlink interface in netdev_nl_bind_rx_doit(), a code path error can cause the same memory buffer to be freed twice—once by the messaging function and again by the error handler. This occurs only under specific conditions (such as when a user's receive buffer is already full), but when triggered, it corrupts kernel memory and can lead to privilege escalation or system crash.

• CVE-2026-53234HIGH 7.8

  A use-after-free vulnerability exists in the IBM EMAC network driver in the Linux kernel. During device removal, the driver defers network device unregistration until after hardware teardown, creating a window where the network stack can still process packets and access freed memory. This can lead to crashes or potential privilege escalation on systems running affected kernel versions. The fix involves explicitly unregistering the network device before tearing down hardware, eliminating the unsafe race condition.

• CVE-2026-53239HIGH 7.8

  CVE-2026-53239 is a use-after-free memory corruption vulnerability in the Linux kernel's IPsec policy management subsystem. The flaw occurs in the xfrm (transform) layer when handling policy deletion and rebuild operations concurrently. A local attacker with user-level privileges can trigger a race condition that causes the kernel to access memory that has already been freed, potentially leading to privilege escalation or system crash. This is a kernel-level defect that requires code execution on the target system but no special capabilities to trigger.

• CVE-2026-53242HIGH 7.8

  A flaw in how the Linux kernel manages audio stream drainage (a process for properly closing ALSA PCM audio connections) can cause kernel memory corruption when multiple linked audio streams are involved. The vulnerability arises from orphaned wait queue entries that remain registered on old queues while being added to new ones during concurrent stream unlinking operations. This list corruption leads to a kernel panic when the system attempts to process a stale pointer, making it a denial-of-service issue affecting local users with basic privileges.

• CVE-2026-53250HIGH 7.8

  A race condition exists in the Linux kernel's AF_XDP socket implementation that allows a local, authenticated user to bypass security checks on network packet checksum metadata. By rapidly modifying shared memory after validation but before use, an attacker can trick the kernel into writing checksums to invalid memory locations, potentially causing a system crash or enabling privilege escalation. The vulnerability requires local system access and affects systems where AF_XDP sockets are actively used for high-performance packet processing.

• CVE-2026-53259HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's IPv6 anycast address handling. When adding IPv6 anycast addresses, a race condition allows the kernel to insert an address into a global hash table after a concurrent teardown process has already removed it from the per-device list and released it. This creates a window where freed memory remains linked in the hash, and subsequent readers encounter dangling pointers. The vulnerability requires local access and can lead to kernel crashes or privilege escalation. The fix moves hash insertion inside the lock-protected section to ensure atomicity with device teardown operations.

• CVE-2026-53262HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation within the pppol2tp socket handler. When an application calls certain ioctl commands on an L2TP socket, the kernel accesses session data without properly protecting it. An attacker with local access can exploit a timing window—triggered via techniques like userfaultfd—to cause the session to be freed while the ioctl operation is still using it. This results in the kernel dereferencing freed memory, potentially leading to privilege escalation or system crash. The vulnerability requires local access and a low-level understanding of kernel memory management, but the consequences are severe.

• CVE-2026-53264HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's traffic control action subsystem. When network filter operations are added and removed at the same time on different CPU cores, a race condition can allow one operation to access memory that has already been freed by another. This occurs because the code freed action objects immediately rather than deferring cleanup until it was safe to do so. The fix restores deferred freeing using RCU (Read-Copy-Update) synchronization, ensuring memory is only reclaimed after all concurrent readers have completed.

• CVE-2026-53265HIGH 7.8

  A race condition exists in the Linux kernel's Device Mapper cache policy subsystem (SMQ). When two processes attempt to invalidate cache blocks simultaneously, they can both check whether a cache entry is in use before either one acquires the necessary lock. The first process removes the entry and frees it; the second process then acts on stale information, potentially corrupting internal data structures or causing a double-free error. This vulnerability requires local access and affects systems running vulnerable kernel versions.

• CVE-2026-53267HIGH 7.8

  A flaw in the Linux kernel's netfilter connection tracking (nft_ct) module allows a local attacker with unprivileged access to write code to kernel memory and crash the system. The issue occurs when firewall rules interact with template connection tracking objects in an unexpected way, causing a memory copy operation to overflow its bounds and corrupt adjacent kernel memory structures. The vulnerability requires local access and the ability to create firewall rules, but doesn't require elevated privileges to trigger.

• CVE-2026-53270HIGH 7.8

  A flaw in the Linux kernel's IP Virtual Server (IPVS) load-balancing module can cause traffic to be routed using an outdated scheduler after an administrator changes the scheduling algorithm. The problem occurs because the kernel clears the scheduler pointer too late in the process, allowing packets to arrive and use old routing decisions even after the scheduler's internal data has been freed. This can lead to crashes, data corruption, or unauthorized information disclosure on systems running vulnerable kernels that rely on IPVS for load balancing.

• CVE-2026-53272HIGH 7.8

  CVE-2026-53272 is a use-after-free vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation. The flaw occurs when I/O completion and filesystem unmount operations race against each other. Specifically, when a decompression operation finishes, the kernel queues work to decompress data asynchronously. However, if the filesystem is unmounting simultaneously, the kernel may free the filesystem's metadata structure (sbi) before that queued work tries to access it, causing a crash or potential privilege escalation. This is a local vulnerability requiring an attacker to have user-level access to the system.

• CVE-2026-53273HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's TEE (Trusted Execution Environment) OptEE subsystem. When a client process terminates before the supplicant (a background service that handles TEE requests) finishes processing, the client may free request data while the supplicant still holds a reference to it. This creates a race condition where the supplicant attempts to access memory that has already been deallocated, potentially allowing privilege escalation or system compromise. The vulnerability stems from a prior fix that made client waits killable during shutdown, inadvertently changing the expected lifetime of request objects.

• CVE-2026-53276HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's Bluetooth ISO implementation. When a socket is being rebound, the code releases a lock while still holding a cached pointer to a connection structure. Between the unlock and the next lock acquisition, a concurrent close operation can destroy that connection and deallocate its memory. The code then attempts to use the freed pointer, causing a crash or potential code execution. The issue affects local attackers with basic privileges who can interact with Bluetooth ISO sockets on the affected system.

• CVE-2026-53286HIGH 7.8

  CVE-2026-53286 is a double-free and use-after-free vulnerability in the Linux kernel's IDPF (Intel Data Plane Development Kit) driver. When the driver attempts to initialize certain auxiliary devices and encounters errors during the add operation, it frees memory incorrectly, leading to potential double-frees and accessing memory after it has been freed. An unprivileged local user could exploit this to crash the kernel or potentially achieve higher privileges.

• CVE-2026-53290HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's GPU display driver (xe) within the EU stall stream closure routine. When a GPU monitoring stream is closed, the driver releases a reference to the device before fully shutting down and freeing the stream's resources. If this causes the device structure to be deallocated prematurely, subsequent cleanup code attempts to access memory that has already been freed, potentially leading to kernel crashes or privilege escalation. This flaw affects systems using the Intel Xe GPU driver on Linux and requires local access and user-level privileges to exploit.

• CVE-2026-53294HIGH 7.8

  A memory management flaw exists in the Linux kernel's mailbox test module where a communication channel can be freed twice when it's reused across different operations. This happens because the code fails to recognize when the receive channel is actually an alias—a reference to the same underlying channel—rather than a separate resource. When cleanup occurs, the system attempts to free the same memory region twice, causing a crash or potential instability.

• CVE-2026-53296HIGH 7.8

  A memory management flaw in the Linux kernel's mailbox-test driver can leak allocated channels and create use-after-free conditions when the driver fails to initialize. The vulnerability arises because error handling during probe does not properly release channels that were obtained before the failure occurs. Since the containing client structure is managed by the kernel's device resource (devm) system, it gets cleaned up automatically; however, the channels it references are not, leaving dangling pointers and wasted memory. This affects systems running vulnerable Linux kernel versions where the mailbox-test module is loaded.

• CVE-2026-53300HIGH 7.8

  A use-after-free vulnerability exists in the Linux kernel's ENETC network driver. When a network command times out, the driver can free a memory buffer while the hardware is still trying to write to it. This can corrupt memory if the freed buffer gets reallocated to another part of the system. The fix converts a locking mechanism from a spinlock to a mutex, introduces proper tracking of DMA buffers, and ensures locks are held during the critical window when responses are being consumed.

• CVE-2026-53341HIGH 7.8

  CVE-2026-53341 is a use-after-free vulnerability in the Linux kernel's file handle decoding mechanism. The issue occurs when the kernel accesses mount namespace data without proper synchronization, allowing a concurrent unmount operation to free the memory while it's still being read. This race condition can crash the kernel or potentially leak sensitive information. The vulnerability requires specific kernel configurations (preemption or strict RCU grace periods enabled) to be exploitable in practice.

• CVE-2026-53356HIGH 7.8

  A bug in the Linux kernel's graphics driver (i915) causes incorrect memory access when reading or writing data from physical memory-backed graphics objects with non-zero offsets. The flaw stems from a pointer type mismatch in the sg_page() function, which returns a struct page pointer but was being treated as a void pointer, causing wrong scaling calculations. This affects older Intel graphics hardware (Gen3/945G/Lakeport) that used physical memory mapping for overlay or cursor planes. An attacker with local access could exploit this to read or modify sensitive kernel memory.

• CVE-2026-53362HIGH 7.8

  A memory corruption vulnerability exists in the Linux kernel's IPv6 packet fragmentation handling. When an unprivileged user sends UDP traffic over IPv6 using specific socket options (MSG_MORE and MSG_SPLICE_PAGES together), the kernel miscalculates buffer sizes during packet assembly. This causes data to be written beyond the intended memory boundary, potentially corrupting kernel memory. The flaw stems from incorrect accounting of fragment gap bytes when the kernel uses the optimized paged-allocation code path for large packets.

• CVE-2026-53406HIGH 7.8

  A vulnerability in Zoom Contact Center's Remote Control feature for Windows allows authenticated users with local system access to escalate their privileges beyond their intended permissions. The issue stems from insufficient validation of data authenticity in the remote control mechanism. An attacker who already has a user account and can log into an affected system could exploit this to gain higher-level system access. This is not a critical worm-spreading vulnerability, but it does create a meaningful pathway for privilege escalation on vulnerable systems.

• CVE-2026-53813HIGH 7.8

  OpenClaw versions before 2026.4.25 contain a vulnerability that allows attackers with workspace access to load executable code or access data from the wrong locations on a system. The flaw stems from how the application resolves where to find memory-core artifacts based on workspace settings, creating a path traversal opportunity. An attacker who already has some level of access to an affected workspace can exploit this to run malicious code with the privileges of the OpenClaw process.

• CVE-2026-53925HIGH 7.8

  Glances, a popular open-source system monitoring tool, contains a vulnerability in versions 4.0.8 through 4.5.4 that allows local attackers with configuration file access to execute arbitrary commands or write to arbitrary files. The issue stems from improper handling of shell metacharacters (>, |, &&) in command configurations. When Glances loads monitoring commands from its configuration file, it fails to validate or escape these special characters, enabling an attacker to redirect output to sensitive files, chain malicious commands, or pipe data to unauthorized programs. This is a local attack requiring file modification privileges but poses significant risk in multi-user or containerized environments.

• CVE-2026-54057HIGH 7.8

  Kitty, a GPU-accelerated terminal emulator, contains a vulnerability in how it handles color control queries. When a user runs certain terminal commands, an attacker can inject malicious input—including newlines and shell commands—that kitty reflects back into the shell without filtering. This allows arbitrary command execution under the user's privileges. The flaw affects all versions before 0.47.3, which includes the fix.

• CVE-2026-54074HIGH 7.8

  Tina is a headless content management system used by developers to manage content without a traditional admin interface. A critical flaw exists in versions of @tinacms/cli before 2.4.3 that allows arbitrary code execution when developers migrate projects from Forestry (an older CMS) to Tina. If an attacker controls or compromises a Forestry-style project configuration, they can inject malicious JavaScript code that runs automatically when a developer executes standard Tina commands. The injected code executes with the developer's full permissions, potentially compromising the entire build environment, source code repositories, and deployment infrastructure.

• CVE-2026-54228HIGH 7.8

  A timing flaw in Red Hat's ABRT (Automatic Bug Reporting Tool) D-Bus service allows any local user to slip malicious files into system directories during a brief window when the system isn't watching. Specifically, an attacker can write arbitrary text files into root-owned crash dump directories by exploiting the SetElement method, bypassing the normal validation that prevents crashes from unpackaged software from being processed. This race condition gives local users a pathway to escalate privileges or corrupt system state.

• CVE-2026-54555HIGH 7.8

  rtk is a tool that filters and compresses command outputs before they reach language model contexts. Versions before 0.42.2 contain a permission-bypass vulnerability in how the permission splitter handles Bash shell constructs. An attacker can craft a command that starts with an allowed prefix (like 'git') but hides a second command using shell execution boundaries that Bash recognizes but rtk's filter does not. The tool incorrectly reports success (exit code 0), causing the permission system to approve the command. The hidden command then executes without the user confirmation or denial that the permission rules were meant to enforce.