By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 63 of 86

• CVE-2026-48735MEDIUM 5.5

  pypdf, a popular open-source Python library for PDF processing, contains a memory exhaustion flaw that allows attackers to craft malicious PDF files triggering excessive memory consumption. The issue stems from how the library parses XMP (Extensible Metadata Platform) metadata within PDFs—an attacker can embed large or unnecessarily complex metadata structures that force the parser to allocate abnormal amounts of RAM. This can degrade system performance or crash applications relying on pypdf to process untrusted PDF documents. The vulnerability affects versions prior to 6.12.1.

• CVE-2026-48985MEDIUM 5.5

  pam_usb is a Linux authentication module that lets users log in using removable USB devices. A bug in versions 0.9.1 and earlier causes the module to crash when it encounters certain output from the system's login service daemon. This crash can lock legitimate users out of services that rely on pam_usb for authentication, such as sudo or login commands. The issue stems from insufficient validation of data returned by the system, leading to a NULL pointer dereference. Version 0.9.2 contains the fix.

• CVE-2026-48991MEDIUM 5.5

  XianYuLauncher, a popular Minecraft Java Edition launcher, has a flaw in versions before 1.5.5 that allows a local attacker to steal authentication credentials during the login process. The vulnerability exists because the launcher uses a simple, predictable method to handle login on your computer without adequate security checks. If someone else can access your device or monitor your network traffic locally, they could intercept the authentication tokens needed to access your Minecraft account. The risk is highest in shared or untrusted computing environments. Updating to version 1.5.5 or later closes this gap.

• CVE-2026-49219MEDIUM 5.5

  ImageMagick, widely used for image processing and manipulation, contains a vulnerability that allows a local attacker with login privileges to bypass security policies and read files that should be restricted. The flaw stems from improper handling of filenames, specifically when symlinks are involved. An attacker could exploit this to circumvent the policy restrictions ImageMagick enforces. This is not a remote vulnerability—it requires local system access and user-level permissions.

• CVE-2026-49406MEDIUM 5.5

  Deno, a modern JavaScript and TypeScript runtime, has a path traversal vulnerability in its module resolver when operating in BYONM (Bring Your Own Node Modules) mode. A malicious package can craft a package.json file with directory traversal sequences (..) in its main field, causing Deno to load files from arbitrary locations on disk rather than from within the package's intended directory. Critically, this circumvents Deno's permission system—files that would normally be blocked by --allow-read restrictions can be read anyway if accessed through a require() call. The issue affects Deno versions prior to 2.7.12 and is resolved in that release.

• CVE-2026-49461MEDIUM 5.5

  CVE-2026-49461 is a denial-of-service vulnerability in pypdf, a widely-used Python library for PDF processing. An attacker can craft a malicious PDF file that causes excessive memory consumption when a user or application extracts text from a page containing a specially-constructed form XObject with self-referential loops. This does not allow data theft or system compromise, but can exhaust memory resources and crash applications that depend on pypdf. The vulnerability is resolved in version 6.12.2.

• CVE-2026-49495MEDIUM 5.5

  Ghidra, the NSA's reverse-engineering framework, contains a flaw that can crash the entire application when you open a specially crafted Mach-O binary file. The problem stems from how Ghidra parses export information in these binaries—if an attacker creates a file with circular references in its export structure, Ghidra will get stuck in an infinite loop, consuming memory until the Java runtime runs out and terminates. This causes the loss of any unsaved work in the active Ghidra session.

• CVE-2026-49760MEDIUM 5.5

  A stack-based buffer overflow exists in Erlang OTP's erl_interface library, specifically in the ei_s_print_term function. When this function processes Erlang terms with extremely large integer representations—those exceeding 2000 characters when encoded—it writes beyond the bounds of its internal 2000-byte stack buffer. The overflow is constrained to hexadecimal and decimal characters (0-9, A-F), which significantly limits the practical attack surface to denial of service rather than arbitrary code execution. The related ei_print_term function, which outputs to files instead of memory buffers, does not suffer from this flaw.

• CVE-2026-50135MEDIUM 5.5

  Hugo, a popular static site generator, contains a vulnerability in versions 0.123.0 through 0.161.1 that allows arbitrary file read when a symlink is present in local theme directories. If an attacker or compromised dependency places a malicious symlink in a theme folder (such as under `themes/`), Hugo's `resources.Get` function will follow that symlink and expose files readable by the Hugo process—potentially including sensitive configuration, environment variables, or other data. This affects only locally-mounted themes; remotely sourced Go modules from GitHub are unaffected because symlinks are stripped during download. The issue stems from a regression where the file system backend began using `Stat` (which follows symlinks) instead of `Lstat` (which does not).

• CVE-2026-50262MEDIUM 5.5

  CVE-2026-50262 is an information disclosure vulnerability in the X.Org X server and Xwayland components. A flawed validation check in the ChangeDrawableAttributes function allows an authenticated local attacker to read beyond the intended buffer boundaries, potentially exposing sensitive data from memory. The vulnerability is limited to information disclosure on standard configurations; a write variant exists but is disabled by default in most deployments.

• CVE-2026-50263MEDIUM 5.5

  CVE-2026-50263 is a use-after-free memory vulnerability in X.Org's X server and Xwayland components that can leak sensitive information from system memory. When a client manipulates window attributes and triggers the screen saver, the CreateSaverWindow() function accesses memory that has already been freed, allowing the attacker to read data that should no longer be accessible. The vulnerability requires local access and low privileges but can expose confidential information without crashing the system.

• CVE-2026-50810MEDIUM 5.5

  A flaw in GPAC's media processing code can cause the application to crash when handling certain streaming media files. An attacker could craft a malicious media playlist file that, when opened by a user, triggers a crash in the smooth_parse_stream_index() function. This is a local denial-of-service vulnerability requiring user interaction—someone must open a crafted file for the crash to occur.

• CVE-2026-50812MEDIUM 5.5

  A flaw in SQLite's Session Extension can crash applications using it when they process a specially crafted changeset file. An attacker with local access who can supply a malformed changeset blob can trigger a denial-of-service condition. The vulnerability stems from the code attempting to dereference a null pointer during changeset application, causing the application to terminate abnormally.

• CVE-2026-52753MEDIUM 5.5

  Ghidra, NSA's widely-used reverse engineering framework, has a memory exhaustion vulnerability in how it handles Rust symbol names. When analyzing a malicious binary containing specially crafted Rust symbols, Ghidra can allocate memory unboundedly, consuming all available RAM and crashing the application. An attacker would need to craft a binary that a security analyst then opens in Ghidra to trigger the crash—this is not remotely exploitable, but it can disrupt analysis workflows and impact incident response timelines.

• CVE-2026-52759MEDIUM 5.5

  Ghidra, the NSA's popular reverse-engineering framework, contains a vulnerability in how it processes Mach-O binary files (the executable format used by macOS and iOS). An attacker can craft a malicious binary with an invalid instruction count that tricks Ghidra into allocating enormous amounts of memory, exhausting system resources and crashing the application. This requires local access and user interaction—someone must open the malicious binary in Ghidra—but the impact is a reliable denial of service.

• CVE-2026-52904MEDIUM 5.5

  A memory leak exists in the Linux kernel's Nouveau graphics driver. During the device initialization process, if a specific system configuration check fails, the driver fails to properly clean up an allocated device object, leaving resources dangling in kernel memory. This is a kernel-level resource exhaustion issue that can be triggered by unprivileged users on affected systems.

• CVE-2026-52905MEDIUM 5.5

  A bug in the Linux kernel's DAMON (Data Access Monitoring) subsystem allows administrators or local users to configure memory monitoring settings with invalid parameters, potentially causing system instability or denial of service. The vulnerability stems from incomplete validation of the minimum region size parameter—it must be a power of two, but the DAMON sysfs interface can accept non-power-of-two values, leading to unaligned memory address ranges that violate kernel assumptions. This creates conditions for crashes or hangs during memory access monitoring operations.

• CVE-2026-52913MEDIUM 5.5

  A vulnerability in the Linux kernel's batman-adv networking module can cause a system crash when network interfaces are disabled. The issue stems from code that continues sending mesh network announcements (OGMs) through interfaces that have been taken offline, leading to attempts to access memory that no longer contains valid data. An unprivileged local user with access to the affected system could trigger this crash, resulting in a denial of service.

• CVE-2026-52916MEDIUM 5.5

  A flaw in the Linux kernel's batman-adv networking module allows a local attacker to crash the system by sending specially crafted fragmented network packets that nest themselves within each other. When the kernel attempts to reassemble these packets, it becomes trapped in recursive processing that consumes kernel stack memory until it runs out, causing a denial of service. The vulnerability requires local network access and appropriate user privileges to exploit.

• CVE-2026-52921MEDIUM 5.5

  A bug in the Linux kernel's netfilter ipset module causes certain hash-based set variants to iterate past their intended range boundaries when processing IPv4 addresses. When a user requests a range of IP addresses to be processed—for example, in firewall or traffic filtering rules—the iterator should stop after handling the last address in that range. Instead, it advances one more step, potentially moving the traversal state outside the original request boundary. This can cause problems on retry operations, where the system might resume from an incorrect position rather than the intended starting point. The issue affects four specific ipset hash variants used in network filtering configurations.

• CVE-2026-52925MEDIUM 5.5

  A Linux kernel vulnerability exists in Virtual Routing and Forwarding (VRF) port removal that can cause a system crash. When a network port is removed from a VRF configuration, the kernel may incorrectly assume it can access Layer 3 device operations on a newly assigned master device (like a bridge) that doesn't support those operations. This leads to a null pointer dereference—essentially the kernel trying to read data from a memory address that doesn't exist. The issue stems from insufficient synchronization during the port removal process, allowing RCU readers (kernel code paths that read without locks) to encounter inconsistent state.

• CVE-2026-52926MEDIUM 5.5

  A memory state management bug exists in the Linux kernel's batman-adv (B.A.T.M.A.N. Advanced) mesh networking module. When the mesh network is torn down, the code removes gateway nodes from the list but fails to clear the reference to the currently selected gateway. This leaves stale gateway state in memory that persists across cleanup operations. If the mesh is recreated later, this orphaned state can interfere with proper initialization and cause the mesh to malfunction. The fix is straightforward: clear the current gateway pointer before iterating through the gateway list during teardown.

• CVE-2026-52928MEDIUM 5.5

  A flaw in the Linux kernel's AF_UNIX socket implementation allows improper handling of the SIOCATMARK socket operation on datagram and sequenced packet sockets. SIOCATMARK is designed to check whether incoming data has reached an urgent marker—a feature that should only apply to stream-based sockets. The kernel currently does not reject this operation on other socket types, potentially leading to unexpected behavior or denial of service. The fix ensures SIOCATMARK returns an unsupported error for non-stream sockets, aligning the kernel's behavior with its own rules for out-of-band messaging.

• CVE-2026-52930MEDIUM 5.5

  A synchronization flaw in the Linux kernel's shared memory (shm) subsystem allows a local privileged attacker to cause a denial of service. The vulnerability exists in how the kernel decides when to clean up abandoned shared memory segments. The cleanup routine checks whether a segment is safe to destroy, but performs this safety check without holding the necessary lock, creating a race condition. Between the time the check passes and the segment is actually removed, another process can attach to it, leaving the kernel in an inconsistent state and potentially triggering a crash or hang.

• CVE-2026-52936MEDIUM 5.5

  This vulnerability describes a performance and availability issue in the Linux kernel's jitterentropy random number generator. The problem occurs because a critical lock (spinlock) is held for too long while the system performs expensive entropy collection and cryptographic operations. When multiple processes try to generate random numbers simultaneously, they waste CPU cycles spinning and waiting for the lock instead of sleeping, causing system slowdowns and potential denial of service. The fix replaces the spinlock with a mutex, allowing contending processes to sleep efficiently rather than spin, improving overall system responsiveness under load.

• CVE-2026-52937MEDIUM 5.5

  A vulnerability in the Linux kernel's tap network interface driver leaks sensitive kernel memory to unprivileged local users. When a user queries the hardware address of a tap or macvtap device using standard network tools, the kernel copies an incompletely initialized data structure to userspace, inadvertently disclosing 8 bytes of kernel stack contents. On systems running macvtap, this leak can expose kernel code pointers and direct-map memory addresses, undermining KASLR (kernel address space layout randomization) protections and providing attackers with information useful for exploiting other vulnerabilities.

• CVE-2026-52938MEDIUM 5.5

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) socket storage mechanism can cause a system crash when the kernel tries to access memory that no longer exists. The vulnerability occurs during a race condition where one part of the kernel clears a reference to storage data while another part is simultaneously trying to read it, resulting in a NULL pointer dereference. This affects scenarios where socket cloning happens during TCP connection establishment and when diagnostic tools query BPF socket storage. The issue is local to the system and requires user-level privilege to trigger.

• CVE-2026-52939MEDIUM 5.5

  A flaw in the Linux kernel's RDS (Reliable Datagram Sockets) over InfiniBand implementation causes a null pointer crash when handling masked atomic operations. When an unprivileged user sends certain atomic messages over an active RDS/IB connection, the kernel fails to properly track the request state, leading to a NULL dereference in interrupt context. This can crash the system or trigger a kernel panic. The issue only manifests on InfiniBand hardware that natively supports masked atomic operations, such as Mellanox MLX4 and MLX5 adapters.

• CVE-2026-52940MEDIUM 5.5

  A bug in the Linux kernel's TUN network interface code fails to properly clear memory before sending it to unprivileged users. When a user reads from a TUN device, the kernel copies a 24-byte header structure to userspace, but only initializes the first 10 bytes. The remaining 14 bytes contain leftover kernel memory from the stack—sensitive data that should never leave kernel space. An attacker with local user privileges can repeatedly read packets and collect fragments of kernel memory, potentially revealing sensitive information used internally by the kernel.

• CVE-2026-52941MEDIUM 5.5

  A vulnerability exists in the Linux kernel's SMC (Shared Memory Communications) networking implementation that can crash a system when tracing is enabled. Specifically, when a tracepoint used to monitor socket messaging is turned on, sending or receiving data over an SMC-D (Shared Memory Communications over DAPL) connection triggers a null pointer dereference. The kernel tries to access link information that doesn't exist for SMC-D sockets, causing a kernel panic. While enabling the tracepoint requires root access, unprivileged users can create SMC-D sockets and trigger the crash.

• CVE-2026-52944MEDIUM 5.5

  CVE-2026-52944 is a permission-bypass flaw in the Linux kernel's ksmbd (SMB server) implementation. The FSCTL_SET_SPARSE operation, which controls whether a file is marked as sparse (a storage optimization technique), fails to verify user permissions before allowing the change. This means an unprivileged user could modify file attributes they shouldn't be able to touch—either because they're on a read-only share or because they lack the necessary write permissions on a writable share. The vulnerability requires local access to trigger but could lead to unauthorized file attribute modifications.

• CVE-2026-52948MEDIUM 5.5

  A flaw in the Linux kernel's I2C device driver allows a local user to crash the system or leave I2C/SMBus hardware in a broken state. The vulnerability stems from an integer overflow when the driver processes timeout values submitted through a system call. An attacker with local access can supply a specially crafted timeout value that bypasses validation checks, causing the driver to set an invalid timeout internally. This leads to premature timeouts and corrupts the SMBus state machine, effectively denying service to legitimate I2C operations.

• CVE-2026-52949MEDIUM 5.5

  A flaw exists in the Linux kernel's memory management subsystem (DRM TTM) where the buffer object shrinking function can enter an infinite loop when a backup operation fails. This happens because the code attempts to remove a buffer from a tracking list before confirming the backup succeeded, leaving the list in an inconsistent state if the operation fails. The fix ensures the removal from the tracking list only occurs after a successful backup, preventing the infinite loop condition.

• CVE-2026-52961MEDIUM 5.5

  A bug in the Linux kernel's Ceph filesystem implementation can cause the system to crash when handling extended attributes (metadata tags attached to files). The problem stems from a timing issue where one part of the code calculates the size of attribute data while another part may simultaneously update that data, leading to an inconsistency. When the code later tries to verify the size matches expectations, the mismatch triggers a kernel panic. This affects systems using Ceph as a networked storage backend, particularly under specific file operation patterns.

• CVE-2026-52963MEDIUM 5.5

  A flaw exists in the Linux kernel's USB audio MIDI handling code. When processing USB MIDI endpoint descriptors, the kernel validates the size of internal descriptor structures but fails to properly bound subsequent reads against the actual available data. An attacker with local access could craft a malicious USB device that provides specially formatted MIDI endpoint descriptors, causing the kernel to read beyond allocated memory regions during descriptor parsing. This results in a kernel crash or denial of service.

• CVE-2026-52964MEDIUM 5.5

  A flaw in how the Linux kernel processes USB MIDI 2.0 device descriptors allows a malformed USB device to trigger an out-of-bounds memory read. When the kernel parses endpoint descriptors from a specially crafted MIDI 2.0 device, it fails to properly validate descriptor boundaries, potentially causing the parser to read memory beyond the intended descriptor region. This could lead to system crashes or information disclosure, but only affects systems where an untrusted USB device is connected and a user with non-root privileges interacts with MIDI functionality.

• CVE-2026-52965MEDIUM 5.5

  This is a memory management bug in the Linux kernel's graphics driver subsystem (DRM/TTM). When the kernel tries to move graphics memory to disk storage and that operation fails, it attempts to restore the memory's position in its tracking list. However, the restoration logic places the memory in the wrong position—ahead of where the system was searching—which causes the kernel to repeatedly examine the same memory block in an infinite loop. This infinite loop can freeze or crash the system. The fix involves changing when certain cleanup operations happen and how they handle memory marked as non-evictable.

• CVE-2026-52966MEDIUM 5.5

  A logic error in the Linux kernel's DRM (Direct Rendering Manager) subsystem can cause a denial of service when handling graphics device file descriptors. The bug stems from a recent change that failed to correctly update an internal pointer during memory management operations, leaving stale references that trigger a warning and potential crash when files are closed. This affects local users who can open DRM device files.

• CVE-2026-52970MEDIUM 5.5

  A memory management flaw exists in the Linux kernel's netfilter module, specifically in how it handles network connection expectations. When the system creates a temporary expectation object for tracking network connections, it fails to properly release the memory reference it holds. This creates a resource leak that can accumulate over time, eventually exhausting available memory and causing the system to become unresponsive or crash. The vulnerability requires local access to trigger, making it a lower-risk issue for most internet-facing systems but a concern for multi-user environments or systems where untrusted local users have access.

• CVE-2026-52972MEDIUM 5.5

  A vulnerability in the Linux kernel's cryptographic socket implementation allows a local attacker to trigger an arithmetic overflow when processing AEAD (Authenticated Encryption with Associated Data) operations. By crafting requests with excessively large associated data lengths, an attacker can cause a denial-of-service condition affecting system stability. The vulnerability requires local access and standard user privileges to exploit.

• CVE-2026-52977MEDIUM 5.5

  A race condition in the Linux kernel's futex (fast userspace mutex) implementation can cause a system lockup when one task times out or receives a signal while waiting to be requeued to another futex. The issue arises because a departing task cannot remove itself from the queue quickly enough when a higher-priority task is holding the necessary locks, leading to deadlock or busy-loop scenarios that freeze the system. The fix involves properly removing waiters from the queue when requeue operations fail, allowing other tasks to progress and preventing the lockup condition.

• CVE-2026-52978MEDIUM 5.5

  A Linux kernel networking subsystem (PSP) fails to enforce proper permission checks on two critical operations: changing device settings (dev-set) and rotating cryptographic keys (key-rotate). Currently, any user on the system who has access to the network namespace can perform these operations, even though they modify shared device state that should be restricted to administrators. This allows unprivileged local users to tamper with PSP configuration and key material without needing root-level capabilities.

• CVE-2026-52979MEDIUM 5.5

  A flaw in the Linux kernel's PSP (Platform Security Processor) networking subsystem can lead to a denial-of-service condition. When creating a network association, the code obtains a reference to a PSP device but fails to verify the device is still active after acquiring a lock. This allows a device unregistration to proceed undetected, leaving the association code operating on stale or invalid device state, ultimately causing the system to crash or become unresponsive.

• CVE-2026-52980MEDIUM 5.5

  CVE-2026-52980 is a memory corruption and denial-of-service vulnerability in the Linux kernel scheduler that can be triggered by a combination of process forking and yield operations. When a new process is created, the kernel's fair scheduling class fails to properly initialize certain deadline tracking state, causing subsequent scheduler operations to compute abnormally large deadline values. If the affected process later yields, these inflated values cascade into corrupted internal accounting structures, potentially rendering the entire scheduler unable to pick runnable processes and causing a system crash. The vulnerability requires local access and unprivileged execution, making it a practical risk in multi-user and containerized Linux environments.

• CVE-2026-52984MEDIUM 5.5

  A flaw in the Linux kernel's network traffic scheduling (netem) module allows queue size limits to be bypassed when packets are reordered. The vulnerability occurs because the queue limit check only counts packets in one internal queue structure but ignores packets placed elsewhere during reordering, enabling total queue size to grow beyond configured limits. This can degrade system performance or cause denial of service conditions on systems relying on network queue limits for stability.

• CVE-2026-52985MEDIUM 5.5

  CVE-2026-52985 is a memory initialization bug in the Linux kernel's netdevsim module. When the kernel builds dummy network packets for trap simulation, it fails to properly zero-initialize the IP header structure, leaving uninitialized memory that can be read by subsequent code. This is a kernel memory safety issue rather than a direct network-exploitable vulnerability. The fix is straightforward: replace a memory allocation function with one that guarantees zeroed memory.

• CVE-2026-52990MEDIUM 5.5

  A vulnerability in the Linux kernel's file notification system causes an inode reference leak when monitoring marks are added and removed concurrently. When a file system mark transitions from being actively tracked to not, the kernel fails to properly release the inode reference, eventually causing processes (like umount) to hang indefinitely. This is a timing-sensitive race condition that requires specific concurrent activity to trigger.

• CVE-2026-52994MEDIUM 5.5

  A flaw in the Linux kernel's virtual socket (vsock) implementation over virtio transport allows unprivileged users to bypass memory resource limits (RLIMIT_MEMLOCK) when using zero-copy message operations. The bug occurs because the kernel fails to properly account for pinned memory pages on the final network packet, allowing an attacker with local access to pin more memory than their account should be permitted, potentially causing denial of service.

• CVE-2026-52995MEDIUM 5.5

  A vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) networking subsystem leaks uninitialized kernel memory to unprivileged local users. When certain RDS connection state queries are made, the kernel copies stack memory that was never properly initialized to user space, potentially exposing sensitive kernel addresses and data. The vulnerability affects code paths where the connection info visitor functions fail to populate all output fields before the buffer is returned to the caller.

• CVE-2026-52996MEDIUM 5.5

  A resource leak vulnerability exists in the Linux kernel's SMB server implementation (ksmbd). When a client attempts to reconnect to a file using durable handle version 2, the server may fail to properly release a reference to a file descriptor if the client's identifier doesn't match what's stored on the server. This causes server memory and file table entries to accumulate over time, potentially degrading performance or causing denial of service as the system exhausts resources.

• CVE-2026-52997MEDIUM 5.5

  A flaw in the Linux kernel's dualpi2 network queue management system can cause the system to crash when configuration changes are applied. The issue occurs when packets are routed to one queue while another queue is empty—the kernel tries to access data from the wrong location and encounters a NULL pointer, causing a denial of service. This vulnerability requires local access to trigger and affects systems using the dualpi2 qdisc for traffic shaping.

• CVE-2026-53001MEDIUM 5.5

  A vulnerability in the Linux kernel's netfilter xtables subsystem allows a local user with limited privileges to cause a denial-of-service condition. The issue stems from improper protocol family restrictions in certain packet filtering modules (xt_mac, xt_owner, xt_physdev, and xt_realm). By crafting specific netfilter rules, an attacker could trigger excessive resource consumption or system crashes. This is a low-privilege local attack with no remote exploitation path.

• CVE-2026-53007MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's Intel ice driver that can crash the system. The flaw occurs when the driver attempts to configure transmit ring parameters but fails partway through the operation. Specifically, the code fails to properly clean up a flag indicating that timestamp functionality is enabled, even though the underlying data structure has been nullified. During error recovery, the code then tries to access that nullified structure, causing a kernel panic. This requires local system access to trigger.

• CVE-2026-53012MEDIUM 5.5

  CVE-2026-53012 is a kernel bug affecting IPv6 routing in Linux. The issue occurs when an IPv6 nexthop (a routing destination point) is replaced with an IPv4 one, and the system fails to update its internal tracking flags. This mismatch causes the kernel to attempt operations on IPv4 routing data while treating it as IPv6, resulting in a crash when traffic tries to use the affected route. An unprivileged local user with network namespace privileges can trigger this by crafting specific routing configuration changes and then sending IPv6 traffic.

• CVE-2026-53013MEDIUM 5.5

  A flaw in the Linux kernel's macvlan networking driver causes a space-reservation mismatch in network interface information reporting. When a macvlan interface is configured with a broadcast cutoff setting other than the default, the kernel fails to allocate enough buffer space for the configuration data when querying interface details. This triggers a warning and prevents the interface from being reported, potentially causing network management tools to fail silently.

• CVE-2026-53014MEDIUM 5.5

  CVE-2026-53014 is a logic error in the Linux kernel's traffic control (tc) packet mirroring feature that causes the system to misidentify device types when redirecting network traffic to multiple destinations simultaneously. When a tc rule redirects packets to several devices at once—particularly when those devices have different underlying transmission modes (like an Ethernet interface versus a tunnel)—the kernel checks the wrong device's configuration, leading it to corrupt packet headers. In severe cases, this can cause the kernel to run out of memory and crash. The vulnerability requires local access to configure tc rules.

• CVE-2026-53015MEDIUM 5.5

  A bug in the Linux kernel's EROFS (Enhanced Read-Only File System) implementation causes incorrect handling of logical cluster numbers on 32-bit systems. The vulnerability stems from using a 32-bit data type (`unsigned long` or `unsigned int`) for a value that can exceed 4 GiB when shifted by the cluster size multiplier. By unifying this value to a 64-bit type, the kernel prevents truncation and data corruption that could occur when the filesystem attempts to access or manipulate file locations beyond the 4 GiB boundary on 32-bit platforms.

• CVE-2026-53017MEDIUM 5.5

  A data loss vulnerability exists in the Linux kernel's F2FS file system implementation. The issue occurs when a newly created file is synchronized to disk (fsync) at the exact moment a checkpoint operation is in progress. Due to incorrect flag interpretation, the kernel may fail to write the file's inode block, resulting in permanent data loss. The vulnerability requires local access and specific timing, making it a moderate but serious threat to systems relying on F2FS for storage.

• CVE-2026-53018MEDIUM 5.5

  A bug in the Linux kernel's f2fs (Flash-Friendly File System) implementation can cause a crash when the garbage collector attempts to read a memory page that has already been updated and moved to a new location. During normal file system operations, a page may be relocated from one disk block to another and marked as up-to-date. If the garbage collector then tries to read that same page from its old location without checking its status first, it triggers a kernel panic. The fix prevents unnecessary read operations on pages that have already been refreshed, eliminating the crash condition.

• CVE-2026-53019MEDIUM 5.5

  A logic error in the Linux kernel's SpaceMIT clock control unit (CCU) driver causes the system to skip necessary frequency scaling operations. When the kernel attempts to change CPU frequency—a routine operation during power management—a reversed conditional check prevents the actual frequency change from being triggered, leading to kernel panics. This affects systems running the vulnerable kernel version on SpaceMIT-based hardware.

• CVE-2026-53021MEDIUM 5.5

  A bug in the Linux kernel's SCSI target subsystem fails to properly validate certain storage device commands. Specifically, when processing UNMAP requests (which deallocate storage blocks), the code checks that the operation stays within the device's capacity but misses cases where the arithmetic wraps around a 64-bit boundary. An authenticated local user could exploit this to trigger a denial-of-service condition by crashing the kernel or causing unexpected behavior.

• CVE-2026-53022MEDIUM 5.5

  A buffer overflow vulnerability exists in the Linux kernel's Dell WMI System Management driver. The driver aggregates firmware-provided configuration strings into fixed 512-byte buffers without properly checking whether all strings will fit. An attacker with local system access could craft malicious firmware data that causes the buffer to overflow, potentially crashing the system or enabling privilege escalation. The vulnerability requires local access and low-level privileges to exploit.

• CVE-2026-53023MEDIUM 5.5

  A flaw in the Linux kernel's NTFS3 file system driver can cause the system to read beyond the boundaries of a memory buffer when displaying a volume label. The problem occurs because the code that converts the volume label from UTF-16 to UTF-8 format doesn't properly null-terminate the resulting string. When a volume label exactly fills the available buffer space, the system may access memory locations outside the intended buffer, potentially causing a denial of service. This requires local access to the system and affects systems that mount NTFS volumes using the NTFS3 driver.

• CVE-2026-53027MEDIUM 5.5

  A bug in the Linux kernel's NTFS3 filesystem driver can cause the system to crash or become unstable when handling compressed or sparse file attributes with specific memory alignment characteristics. The issue occurs because the code fails to load necessary metadata for certain file clusters before attempting to allocate new storage space, leading to an unexpected warning condition that can trigger a kernel panic. This affects systems running vulnerable Linux kernels that use NTFS3, particularly those storing compressed or sparse files.

• CVE-2026-53028MEDIUM 5.5

  A coding error in the Linux kernel's USB Type-C driver can cause a system crash when the driver attempts to register a USB Type-C partner device and that registration fails. The code checks whether the registration failed but does not exit early; instead it continues executing and tries to use the failed result as if it were valid, leading to a crash. This affects systems with USB Type-C controllers using the TI TUSB322 driver.

• CVE-2026-53029MEDIUM 5.5

  A logic flaw in the Linux kernel's NTFS3 filesystem handler can cause the system to use an uninitialized memory value during certain file operations. When the kernel attempts to map file regions for input/output, it may fail to properly initialize a critical variable (lcn) under specific conditions, leading to a kernel crash. The issue occurs when handling files or filesystem states that trigger a zero-length condition without setting up required data structures first. An unprivileged local user can trigger this by attempting to read or write to specially crafted NTFS3 filesystem files.

• CVE-2026-53030MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Renesas i3c master driver. When the driver processes i3c transfer operations, it allocates internal data structures that are never properly freed, causing memory to accumulate over time. This can lead to denial of service if an attacker with local access repeatedly triggers the affected code path, eventually exhausting system memory and causing the kernel to become unstable or crash.

• CVE-2026-53032MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's eBPF map handling code. When a scalar register is incorrectly stored into a kernel pointer (kptr) slot, the kernel fails to validate the pointer type before attempting to dereference memory, causing a kernel crash. This is a local privilege issue that requires an attacker with local access and the ability to run eBPF programs.

• CVE-2026-53034MEDIUM 5.5

  A race condition in the Linux kernel's socket map (sockmap) implementation can cause a kernel crash when BPF programs attempt to update socket maps while Unix domain stream sockets are being connected. The vulnerability occurs because the kernel marks a socket as established before fully initializing its peer connection, creating a narrow window where a BPF sockmap update operation may dereference a null pointer. An attacker with local access and permission to load BPF programs could trigger this null-pointer dereference, causing a denial of service. The issue is resolved by adding a null-check in the Unix stream socket protocol update handler to ensure the peer socket is properly initialized before attempting to access it.

• CVE-2026-53035MEDIUM 5.5

  CVE-2026-53035 is a deadlock vulnerability in the Linux kernel's eBPF (Berkeley Packet Filter) subsystem, specifically within the Unix domain socket iterator and socket map components. When a BPF program iterates over Unix sockets and attempts to update a socket map during iteration, the kernel can deadlock because the same lock is acquired twice. This occurs because the iterator holds a fast-path lock on the socket, and the socket map update operation tries to acquire the same lock again, causing the system to hang. The vulnerability requires local access and elevated privileges to trigger.

• CVE-2026-53037MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's USB HID (Human Interface Device) driver reset handling. When a USB device combines HID functionality with storage or UAS (USB Attached SCSI) components, the kernel must reset all components together. The vulnerability occurs because memory allocation during the reset process can trigger block I/O operations, which deadlock against a mutex held during device reset. This causes the system to hang when such hybrid USB devices encounter errors requiring reset.

• CVE-2026-53038MEDIUM 5.5

  A vulnerability in the Linux kernel's IMA (Integrity Measurement Architecture) subsystem can trigger a memory safety bug when the kernel attempts to look up hash algorithm names for TPM banks that the system doesn't recognize. Specifically, when a TPM chip reports support for a hash algorithm (like SHA3-256) that the kernel doesn't yet have in its algorithm table, the code sets an invalid index and later uses that index to access a global array of algorithm names, reading past the array bounds. This causes a kernel crash (denial of service) during system initialization. The issue is particularly relevant as newer TPM specifications include algorithms not yet reflected in all kernel versions.

• CVE-2026-53039MEDIUM 5.5

  A flaw in the Linux kernel's OCFS2 filesystem implementation allows a local user to trigger a kernel panic (denial of service) by providing specially crafted input to the OCFS2_IOC_GROUP_ADD ioctl. The vulnerability stems from the code attempting to cache group descriptor information before properly validating it, causing an assertion failure in the buffer management code.

• CVE-2026-53042MEDIUM 5.5

  A flaw in the Linux kernel's fwctl subsystem can cause the system to crash when removing certain devices. The issue stems from a module initialization ordering problem: the CXL driver loads before fwctl and tries to register devices before fwctl is ready, leaving internal data structures uninitialized. When those devices are later removed, the kernel attempts to clean up the uninitialized structures, triggering a crash. This affects systems using Compute Express Link (CXL) devices.

• CVE-2026-53047MEDIUM 5.5

  A flaw in the Linux kernel's EFI capsule loader uses the wrong data size when expanding memory for storing physical hardware addresses. On 32-bit systems with PAE (Physical Address Extension), this miscalculation allocates half the space needed, risking a buffer overflow when the kernel writes address data. On common 64-bit systems, the error goes undetected because pointer and address sizes happen to match.

• CVE-2026-53048MEDIUM 5.5

  CVE-2026-53048 is a NULL pointer dereference vulnerability in the Linux kernel's GFS2 (Global File System 2) subsystem that can cause a system crash or denial of service during filesystem unmount operations. The issue occurs because the code attempts to access memory that has already been freed, triggering an unhandled exception. A local user with standard privileges can trigger this condition, making it a practical concern for systems running vulnerable kernel versions.

• CVE-2026-53051MEDIUM 5.5

  A flaw in the Linux kernel's Tegra194 PCI endpoint controller causes the system to hang when the PCI reset signal is toggled twice. The problem occurs because the driver tries to access certain hardware registers before the controller has been powered on. When the reset signal is deasserted (released), the initialization process attempts to clear memory regions by writing to registers that only work after the core is fully powered. This creates a hardware timeout that freezes the system. The fix reorders the initialization sequence so the core is powered on first, then the register access happens.

• CVE-2026-53052MEDIUM 5.5

  A flaw exists in the Linux kernel's QCOM DSP6 audio topology driver where the code accesses widget private data without first verifying the widget type. Virtual widgets—which don't map to actual DSP graph structures—can trigger incorrect memory access when processed. This is a local denial-of-service risk affecting systems using this audio subsystem.

• CVE-2026-53056MEDIUM 5.5

  A Linux kernel flaw in the display processor unit (DPU) driver can cause a mismatch between CPU power rail voltage and clock frequency during sleep-and-wake cycles. When the system suspends the display subsystem, the voltage drops to a minimal level but the clock speed doesn't follow, leaving them out of sync. On resume, this mismatch can cause instability or system crashes because the low voltage cannot support the high clock rate. The fix removes an incorrect power-down call that was causing the voltage to drop prematurely.

• CVE-2026-53058MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's Cadence MHDP8546 display bridge driver. When certain error conditions occur during display mode setup (specifically in the atomic_enable function), the driver attempts to access a data structure that hasn't been properly initialized, causing a system crash. The vulnerability affects systems using this display bridge controller, particularly in scenarios where the bridge connector is attached without an explicit connector object. An authenticated local attacker can trigger this by inducing error conditions in the display link initialization, resulting in a denial of service.

• CVE-2026-53060MEDIUM 5.5

  CVE-2026-53060 is a memory leak in the Linux kernel's device mapper cache subsystem. When the cache metadata system attempts to abort operations while the underlying block manager is in read-only mode, it fails to release a temporary block manager object, causing memory to accumulate. This occurs specifically during certain cache device table reload and resume operations. The leak is triggered by a sequence of suspend/resume cycles combined with metadata I/O errors, which can occur in production environments when cache devices encounter transient or permanent storage faults.

• CVE-2026-53061MEDIUM 5.5

  A flaw in the Linux kernel's device mapper cache subsystem can cause dirty data to be incorrectly loaded into passthrough mode, risking data loss. The issue arises because the kernel checks whether cached data is clean at the wrong time—during table setup rather than just before activation. When LVM preloads a new table configuration while metadata updates are still in progress, the validation fails to catch dirty blocks that should not enter passthrough mode. An attacker with local access and sufficient privileges could exploit this by creating a writeback cache, preloading a passthrough table, writing data to make blocks dirty, and then resuming the table, causing unintended data handling.

• CVE-2026-53063MEDIUM 5.5

  A flaw in the Linux kernel's device mapper cache subsystem causes write operations to hang when the cache is running in passthrough mode and invalidation occurs. The bug stems from incomplete logic in the invalidate_remove() function that sets up write requests but fails to submit them, leaving applications waiting indefinitely for I/O completion. This is a local issue requiring kernel privileges to trigger, but can severely disrupt system stability.

• CVE-2026-53064MEDIUM 5.5

  CVE-2026-53064 is a null pointer dereference flaw in the Linux kernel's dm-cache subsystem that occurs when the cache device is operating in passthrough mode and concurrent writes target the same cached block during cache invalidation. When the bio prison cell lock acquisition fails due to contention, the code attempts to unlock a cell that was never successfully locked, resulting in a kernel crash. This is a local denial-of-service vulnerability requiring local system access and can be triggered through concurrent I/O operations.

• CVE-2026-53065MEDIUM 5.5

  A memory resource leak has been identified in the Linux kernel's STi audio driver. When the driver is loaded and unloaded, certain internal data structures are not properly cleaned up, allowing memory to accumulate over time. While this doesn't directly compromise data or enable unauthorized access, repeated driver loads and unloads can degrade system stability and consume available memory resources. The fix is straightforward: the kernel team updated the code to use automatic resource management, ensuring these structures are freed when the driver is no longer needed.

• CVE-2026-53066MEDIUM 5.5

  A bug in the Linux kernel's graphics driver for certain ARM-based systems (sun4i backend) fails to properly validate error conditions when retrieving GPU plane state. An unprivileged local user can trigger this code path and cause a kernel crash (denial of service), but cannot execute code or escalate privileges.

• CVE-2026-53073MEDIUM 5.5

  A flaw in the Linux kernel's Bluetooth subsystem can cause a denial of service when the Bluetooth UART driver fails to properly initialize. Specifically, when device registration fails, a flag indicating successful protocol initialization is not cleared before releasing resources. This creates a window where incoming Bluetooth data over UART can trigger handlers that access memory that has already been freed, causing the system to crash. The issue affects local users with appropriate permissions and requires exploitation through Bluetooth UART interfaces.

• CVE-2026-53074MEDIUM 5.5

  CVE-2026-53074 is a denial-of-service vulnerability in the Linux kernel's BPF (Berkeley Packet Filter) test framework. The vulnerability occurs when the kernel attempts to test BPF programs using artificially crafted network packets. Specifically, when a test packet claims to be IPv4 or IPv6 but lacks the required network header data, the kernel can crash or hang because it tries to read header information that doesn't exist in the packet. The fix ensures the kernel validates that sufficient packet data is present before attempting to access network headers, preventing the crash.

• CVE-2026-53079MEDIUM 5.5

  A memory leak exists in the Linux kernel's network packet scheduling subsystem. When the kernel defers cleanup of dropped packets, a mechanism designed to optimize performance can fail to free memory properly if certain conditions aren't met. Specifically, if a network queue (qdisc) doesn't have the TCQ_F_DEQUEUE_DROPS optimization flag enabled, packets marked for deletion get stranded in memory instead of being released. This causes the kernel to gradually consume more memory over time as network traffic is processed, potentially leading to system slowdown or denial of service if memory exhaustion occurs.

• CVE-2026-53080MEDIUM 5.5

  A flaw in the Linux kernel's traffic control (TC) packet classifier subsystem can trigger a kernel crash. Specifically, when using the 'fw' (firewall mark) classifier on shared traffic control blocks, the kernel may attempt to process an invalid filter before it is fully initialized. This creates a race condition where incoming packets hit code paths that dereference NULL pointers, causing a kernel panic. The vulnerability is triggered by a sequence of TC filter additions on a shared egress block combined with active packet transmission. While the issue requires local access and a privileged user account to set up malicious TC rules, the crash itself is a denial of service against the entire system.

• CVE-2026-53082MEDIUM 5.5

  A flaw in the Linux kernel's ham radio 6pack driver causes the system to process corrupted data bytes that should be skipped. When the TTY (terminal) layer detects transmission errors, it marks those bytes with error flags. The vulnerable code ignores these flags and attempts to decode the bad bytes anyway, leading to the kernel reading from uninitialized memory. An unprivileged local user with access to a 6pack device could trigger this condition, potentially causing a denial of service.

• CVE-2026-53083MEDIUM 5.5

  A flaw in the Linux kernel's BPF (Berkeley Packet Filter) subsystem can cause the system to become unresponsive when clearing certain types of maps with many entries. The issue occurs in the cleanup routine that removes file descriptors from PROG_ARRAY maps—a core data structure used by the kernel's in-kernel virtual machine. When processing large maps, the cleanup loop does not yield control back to the scheduler, starving the kernel's RCU (Read-Copy-Update) synchronization mechanism and triggering watchdog warnings. This is a local denial-of-service condition that requires authenticated access to trigger.

• CVE-2026-53084MEDIUM 5.5

  A lock ordering vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) task virtual memory area (VMA) iterator. The issue occurs when the kernel holds a per-VMA lock while executing a BPF program, which can lead to a circular lock dependency when BPF helper functions try to acquire locks that depend on the memory map lock. This can cause system deadlocks or denial of service. The fix snapshots the VMA data structure while holding the lock, then releases the lock before the BPF program executes, eliminating the circular dependency. The vulnerability requires local access and does not allow privilege escalation or information disclosure.

• CVE-2026-53093MEDIUM 5.5

  A flaw in the Linux kernel's Broadcom WiFi driver (brcmfmac) allows a local user to trigger a system crash by exploiting improper error handling. When the driver adds a wireless core component during initialization, it fails to check whether the operation succeeded or returned an error. An unprivileged local attacker can cause the system to dereference invalid memory, leading to a denial of service.

• CVE-2026-53095MEDIUM 5.5

  A vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) subsystem allows unprivileged local users to corrupt kernel function arguments through a chain of two eBPF programs. By combining a kprobe program (which monitors kernel functions) with a freplace program (which wraps or replaces other programs), an attacker can manipulate CPU registers that control function parameters, causing the kernel to execute with altered behavior. This could lead to a denial of service or logic corruption within the kernel.

• CVE-2026-53099MEDIUM 5.5

  A configuration naming issue in the Linux kernel's Control Flow Integrity (CFI) implementation causes security-critical code to be inadvertently excluded during compilation. When the kernel build system uses an outdated configuration option name (CONFIG_CFI_CLANG) instead of the current standard (CONFIG_CFI), the CFI protection mechanism for destructors in BPF programs fails to activate, leaving those code paths vulnerable to control flow attacks. This affects systems built with the incorrect configuration flag, potentially on any architecture where CFI is intended as a defense.

• CVE-2026-53100MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's WiFi driver (mt76) that can cause the system to hang when using the remain-on-channel feature. The issue occurs because two related functions attempt to acquire the same lock while already holding it, creating a circular wait condition. This leads to a denial of service where WiFi functionality becomes unresponsive until the system is restarted.

• CVE-2026-53101MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's MT7921 Wi-Fi driver that can freeze the system during Wi-Fi station removal. When the driver attempts to safely stop a background work queue, it can become stuck waiting for that work queue to finish—but the work queue itself is blocked trying to acquire a lock that the waiting code already holds. This creates a mutual deadlock where neither side can proceed. The issue occurs specifically when removing a Wi-Fi station connection, a routine operation that could be triggered by normal device management or user actions.

• CVE-2026-53102MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's MediaTek WiFi driver (mt76) where allocated memory is not properly freed when certain operations fail during station configuration. The vulnerability occurs when intermediate functions encounter errors after memory is allocated but before it can be properly released, potentially leading to memory exhaustion over time. This is a kernel-level issue that affects systems with MediaTek WiFi hardware running vulnerable kernel versions.

• CVE-2026-53103MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 devices can cause the system to become unresponsive when removing a wireless station. The issue stems from a deadlock condition where two parts of the driver code try to acquire the same lock, with one waiting for the other to release it—but that other code is blocked waiting for the first to finish. This creates a circular dependency that halts progress. The problem surfaces specifically during station removal operations when the driver attempts to abort pending radio operations.