By year

Vulnerabilities disclosed in 2026

CVEs published in 2026 with SEC.co analysis.

8541 published vulnerabilities · page 64 of 86

• CVE-2026-53104MEDIUM 5.5

  A memory leak exists in the Linux kernel's MT76 WiFi driver that occurs during device destruction or module unload. The issue affects how receive (RX) queues manage associated memory pools—specifically, page pools are not properly cleaned up even when queues lack NAPI association, such as WED RRO (Ring Resource Optimize) queues when WED (Wireless Ethernet Dispatch) is enabled. This causes memory to remain allocated and inaccessible after the driver unloads, degrading system resource availability over time or after repeated driver restarts.

• CVE-2026-53105MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 chipsets can cause the system to crash if the driver attempts to process network transmission without proper initialization. The vulnerability exists because the code tries to access data from an uninitialized network interface object without first checking whether that object exists. An attacker with local access to a system running the affected driver could trigger this crash, causing a denial of service.

• CVE-2026-53106MEDIUM 5.5

  CVE-2026-53106 is a deadlock vulnerability in the Linux kernel's eBPF (extended Berkeley Packet Filter) local storage subsystem. The issue occurs when code running in NMI (Non-Maskable Interrupt) context attempts to delete local storage entries, which can cause the system to hang. The kernel developers have implemented a targeted fix that prevents deletion operations from proceeding when called from NMI context, returning an error instead of allowing the unsafe operation to proceed.

• CVE-2026-53107MEDIUM 5.5

  A flaw was found in how the Linux kernel's libertas WiFi driver handles USB data transmission. The driver was using a function that blocks (pauses) to prevent multiple transmission requests from overlapping, but this function can be called during interrupt handling—a special CPU context where blocking operations are forbidden. This mismatch can cause the system to sleep when it shouldn't, leading to kernel instability. The fix changes the approach: instead of forcefully stopping in-flight USB requests, the driver now checks whether a request is already pending and returns an error if one is, avoiding the problematic blocking call during interrupt handling.

• CVE-2026-53111MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's BPF (Berkeley Packet Filter) subsystem, specifically in the test_run functionality used to validate BPF programs. When certain BPF encapsulation helper functions attempt to access network device information during testing, they may crash the kernel if the test framework hasn't properly initialized the socket buffer's destination reference. This is a local denial-of-service issue that requires user-level access to trigger.

• CVE-2026-53113MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's WiFi driver (ath11k) that affects beacon template setup functions. When these functions encounter errors during parameter setup, they fail to properly release allocated memory for beacon templates. This can cause memory to accumulate over time, eventually degrading system performance or causing denial of service on affected devices, particularly WiFi access points and embedded systems running the vulnerable kernel code.

• CVE-2026-53114MEDIUM 5.5

  A flaw in the Linux kernel's AMD IBS (Instruction-Based Sampling) performance monitoring code allows a local attacker with limited privileges to trigger a fatal system crash. The vulnerability stems from the performance monitoring subsystem making an unsafe function call (perf_allow_kernel) directly from an NMI interrupt handler—a low-level, non-maskable interrupt context where such calls are dangerous. The fix relocates this permission check to event initialization time, caching the result so the NMI handler no longer needs to invoke the unsafe function.

• CVE-2026-53121MEDIUM 5.5

  A memory leak has been identified in the Linux kernel's AMD P-State driver, specifically in the CPU initialization code path. When the driver fails to configure power efficiency settings during CPU initialization, it deallocates resources improperly, leaving allocated memory orphaned in the system. Over time, repeated initialization failures could accumulate unused memory, degrading system stability and performance. This vulnerability requires local access to trigger and affects systems running vulnerable kernel versions with AMD P-State enabled.

• CVE-2026-53122MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's btrfs filesystem when the flushoncommit mount option is enabled. The issue occurs when a reflink operation (copy-on-write file cloning) interacts badly with the transaction commit process. Specifically, when copying inline file data to an offset beyond the current file size, a race condition can cause two kernel tasks to deadlock: one waiting on a file extent lock held by the other, while the other waits for a transaction to complete. This results in a system hang that can freeze processes and make the system unresponsive.

• CVE-2026-53123MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's RAID 5/6 reshape process. When direct I/O operations cross a reshape boundary, they wait for reshape progress while holding system references. If a user freezes the reshape and attempts to suspend the RAID array, the kernel can deadlock: the waiting I/O operations need reshape to continue, but the reshape thread is frozen, preventing the I/O from completing and suspension from finishing. This affects systems using md-raid arrays that perform live reshaping with concurrent I/O.

• CVE-2026-53124MEDIUM 5.5

  A vulnerability in the Linux kernel's ublk (userspace block device) subsystem can cause I/O cancellation to hang indefinitely when a userspace server process crashes during device recovery. The issue stems from how cancellation flags are managed: when a ublk server dies mid-recovery after fetching only some of the pending I/O operations, those fetched operations retain their cancellation flags and cannot be properly completed. This leaves I/O commands in a stuck state, potentially preventing graceful recovery or shutdown of the affected block device. The fix resets the cancellation flag for each I/O as it is fetched, rather than deferring this reset until all operations for a queue have been processed.

• CVE-2026-53125MEDIUM 5.5

  This is a Linux kernel bug that causes a deadlock when administrators try to clear an MD (multiple device) RAID array via the sysfs interface. When the "clear" command is issued, the kernel's internal locking mechanism gets confused about object ownership and tries to acquire the same lock twice simultaneously, causing the system to hang. The issue stems from improper reference counting—the kernel drops a reference to the array object too early, before properly releasing control of a protective mechanism that sysfs uses. This prevents legitimate array management operations and can make systems unresponsive.

• CVE-2026-53126MEDIUM 5.5

  A memory leak exists in the Linux kernel's block I/O (blk-cgroup) subsystem. When certain disk throttling operations fail internally, the kernel forgets to release a reference to the disk device, preventing it from being properly freed from memory. This causes a resource leak that accumulates over time as the system handles throttling requests, potentially leading to memory exhaustion or system instability. The bug was introduced when the kernel code was refactored to use a different internal data structure.

• CVE-2026-53127MEDIUM 5.5

  CVE-2026-53127 is a memory leak vulnerability in the Linux kernel's block device subsystem. When the kernel attempts to revalidate disk zones—a routine operation for certain storage hardware—and encounters an error, it fails to properly clean up allocated memory. This leaked memory accumulates over time, potentially causing system instability or service disruption on affected Linux systems.

• CVE-2026-53128MEDIUM 5.5

  A vulnerability in the Linux kernel's DRBD (Distributed Replicated Block Device) subsystem involves incorrect handling of RCU (Read-Copy-Update) synchronization primitives in the drbd_adm_dump_devices() function. The function calls rcu_read_unlock() without a corresponding prior call to rcu_read_lock(), creating an imbalance in RCU lock management. This can lead to kernel stability issues and potential denial of service. The defect was identified through automated static analysis using the Clang thread-safety checker.

• CVE-2026-53134MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem can leak uninitialized kernel memory to unprivileged local users. When the netfilter FIB module processes certain lookup failures or network interface checks, it fails to properly clear all memory locations it claims to initialize, leaving stale stack data accessible to userspace code. An attacker with local access could read sensitive kernel information through carefully crafted netfilter rules.

• CVE-2026-53135MEDIUM 5.5

  A flaw in the Linux kernel's AMD display driver debugfs interface can cause system crashes when users interact with a specific debug file. The vulnerability occurs in two ways: first, the code assumes a graphics connector is always attached to an active display pipeline, but this isn't true during hot-plug events or temporary disconnections—attempting to debug while in this state triggers a null pointer crash. Second, the same function blindly copies 36 bytes from user input regardless of how much data was actually provided, potentially reading beyond the user's buffer. Both issues require local access with standard user privileges to exploit.

• CVE-2026-53139MEDIUM 5.5

  A vulnerability in the Linux kernel's Direct Rendering Manager (DRM) v3d driver allows local users to cause a denial of service by submitting graphics compute shader dispatch jobs with zero workgroup dimensions. When a compute shader is kicked off with zero counts in any dimension, the kernel should treat this as a no-op and skip execution; instead, the driver was allowing the submission through to hardware, which would misinterpret the zero as 65536—exceeding the valid maximum of 65535 and potentially causing system instability or hangs. This issue is particularly relevant for indirect compute shader dispatch jobs, where workgroup counts are only known at runtime from buffer contents.

• CVE-2026-53140MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) v3d driver. When processing compute shader dispatch (CSD) jobs with indirect workgroup counts, the driver fails to properly clean up memory mappings if any workgroup count is zero. This causes virtual address mappings to remain allocated, gradually consuming kernel memory. The issue is localized to a single code path and requires local access to exploit, making it a moderate risk to systems where untrusted local users can submit graphics workloads.

• CVE-2026-53141MEDIUM 5.5

  CVE-2026-53141 is a memory leak vulnerability in the Linux kernel's Direct Rendering Manager (DRM) v3d graphics driver. The vulnerability exists in the performance monitor reference counting logic, where the kernel fails to properly release memory references in three specific code paths. An unprivileged local user could trigger these memory leaks through GPU-related system calls, gradually exhausting kernel memory and causing system instability or denial of service. The vulnerability requires local access and does not enable privilege escalation or data theft.

• CVE-2026-53142MEDIUM 5.5

  The Linux kernel's xe graphics driver can crash when a system suspends or shuts down on certain Intel hardware where the display is disabled by hardware fuses. The driver keeps track of whether display hardware should be active, but fails to update this state when display is disabled after initial detection. This causes the driver to attempt operations on an uninitialized display configuration, resulting in a crash. The issue affects users with Intel GPUs where display functionality is hardware-disabled, particularly during power management transitions.

• CVE-2026-53144MEDIUM 5.5

  A flaw in the Linux kernel's AMD KFD (Kernel Fusion Driver) module can crash the system when a user-mode application provides invalid parameters to a debug trap function. Specifically, when an application requests to suspend GPU queues but supplies a non-zero queue count without a valid queue pointer, the kernel attempts to dereference a NULL pointer, triggering a panic. An unprivileged local user can exploit this to cause a denial of service.

• CVE-2026-53150MEDIUM 5.5

  A flaw in the Linux kernel's Thunderbolt subsystem allows a local attacker with standard user privileges to crash the system by supplying a specially crafted zero-length property entry. The vulnerability exists in the validation logic that checks incoming Thunderbolt XDomain properties; when a TEXT property has zero length, the code attempts to null-terminate a string at an invalid memory location, causing a buffer underflow. This is a denial-of-service issue affecting local system stability.

• CVE-2026-53152MEDIUM 5.5

  A NULL-pointer dereference vulnerability exists in the Linux kernel's Rockchip eMMC controller driver affecting very old SoC variants (RK2928, RK3066, RK3188). These legacy controllers lack support for high-speed UHS modes and traditionally had minimal driver initialization. A recent kernel commit added memory clock auto-gating logic that assumes driver private data exists, causing the old controllers to crash when they access uninitialized memory structures. The vulnerability requires local access and results in denial of service.

• CVE-2026-53154MEDIUM 5.5

  CVE-2026-53154 is a memory management bug in the Linux kernel's handling of huge pages (a performance optimization for large memory allocations). When the kernel tries to copy a huge page and that copy fails—for example, because the source page is corrupted (hwpoisoned)—it doesn't properly restore the memory reservation that was consumed for that operation. This leaves a task unable to use memory it had reserved, potentially causing it to crash with a SIGBUS signal later. The issue affects two specific code paths: copying huge pages during fork operations and when using the userfaultfd mechanism for memory fault handling.

• CVE-2026-53155MEDIUM 5.5

  A bug in the Linux kernel's memory management code corrupts the state of anonymous page tracking when device-private memory (used by GPUs and accelerators) is involved. The kernel incorrectly interprets memory flags when migrating pages between RAM and device memory, leading to assertions that crash the system. The issue surfaces in scenarios where a process with child processes (fork) migrates memory to and from device-private storage, particularly with large pages. A local user can trigger this by running specific memory-migration workloads.

• CVE-2026-53158MEDIUM 5.5

  CVE-2026-53158 is a NULL pointer dereference in the Linux kernel's fastrpc driver that can cause a system crash during boot on Qualcomm Snapdragon platforms. The vulnerability occurs when the DSP (Digital Signal Processor) sends a message to the kernel before the fastrpc driver finishes initializing. The kernel tries to access an uninitialized data structure, leading to a crash. This is a local availability issue requiring local access, affecting systems running vulnerable kernel versions on affected Qualcomm platforms.

• CVE-2026-53163MEDIUM 5.5

  CVE-2026-53163 is a null pointer dereference vulnerability in the Linux kernel's real-time mutex (rtmutex) locking mechanism. The flaw occurs when the kernel attempts to remove a waiter from a mutex queue without first verifying that the waiter is actually enqueued. This can happen during certain futex (fast userspace mutex) operations, particularly FUTEX_CMP_REQUEUE_PI calls. An unprivileged local user with limited access can trigger this condition, causing the kernel to crash and resulting in a denial of service. The vulnerability stems from incomplete deadlock detection logic that fails to properly initialize a waiter structure before the kernel later tries to clean it up.

• CVE-2026-53164MEDIUM 5.5

  A flaw in the Linux kernel's I/O memory management unit (IOMMU) and DMA handling can cause a system crash or hang when certain NVMe drives—particularly Thunderbolt-based SSDs—trigger software I/O translation lookaside buffer (SWIOTLB) operations with unaligned memory buffers. The kernel incorrectly attempts to map a zero-length memory region, fails, and then corrupts the mapping during error recovery. This is most commonly triggered by smartctl passthrough commands on affected Thunderbolt NVMe hardware.

• CVE-2026-53167MEDIUM 5.5

  A vulnerability in the Linux kernel's FUSE (Filesystem in Userspace) subsystem allows uninitialized memory to be accessed through the FUSE_NOTIFY_RETRIEVE operation. The issue arises because FUSE_NOTIFY_RETRIEVE can return data from page cache entries that haven't been properly initialized, potentially exposing sensitive information from kernel memory. The vulnerability only has meaningful security impact on systems that don't automatically zero-initialize memory allocations at boot time—most modern distributions enable this protection by default.

• CVE-2026-53168MEDIUM 5.5

  A vulnerability exists in the Linux kernel's FUSE (Filesystem in Userspace) subsystem where the pagecache notification operations FUSE_NOTIFY_STORE and FUSE_NOTIFY_RETRIEVE can be exploited to directly manipulate kernel-internal directory cache structures. These operations were intended for regular files only, but the kernel failed to properly validate request targets. An unprivileged local attacker could weaponize this to inject bogus data into directory caches, triggering kernel warnings and potentially causing denial of service or unexpected behavior. The fix restricts these operations to regular files and rejects misuse with an error code.

• CVE-2026-53169MEDIUM 5.5

  CVE-2026-53169 is a denial-of-service vulnerability in the Linux kernel's Ethos-U NPU driver. When userspace sends an unsupported NPU_OP_RESIZE command through the DRM interface, the driver's placeholder code unconditionally triggers a kernel warning. On systems configured to panic on warnings, any user with access to the DRM device can crash the kernel. The fix replaces the warning trigger with a proper error rejection, preventing both the spam and potential panic.

• CVE-2026-53177MEDIUM 5.5

  A vulnerability in the Linux kernel's Broadcom NetXtreme driver can cause a system crash when PCIe error recovery runs on a network interface card that has been administratively closed. The driver attempts to access memory structures that only exist when the NIC is active, leading to a NULL pointer dereference. An attacker with local access could trigger a PCIe error condition to crash the system or cause denial of service.

• CVE-2026-53181MEDIUM 5.5

  A flaw in the Linux kernel's virtual socket (vsock) implementation causes a resource leak when establishing connections between a guest and host via VMCI (VMware Communications Interface). When a server fails to complete the connection handshake—due to malformed packets, memory allocation issues, or event subscription problems—the kernel fails to properly clean up its internal connection tracking. Each failed attempt leaves a small piece of state behind, and after enough failures, the system silently rejects all new connection attempts. Restarting the affected process is the only recovery mechanism.

• CVE-2026-53190MEDIUM 5.5

  CVE-2026-53190 is a memory management bug in the Linux kernel's DRM (Direct Rendering Manager) virtio driver. When the driver attempts to wait on a DMA fence—a synchronization primitive used in graphics operations—it fails to properly release a reference to a fence object if an error occurs during the wait operation. This reference leak means memory is not freed as it should be, potentially leading to memory exhaustion if the condition is triggered repeatedly. The bug affects only the virtio GPU driver and requires local access to trigger.

• CVE-2026-53197MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's IPsec Traffic Flow Security (IPTFS) implementation. When the system destroys an IPTFS state object, it attempts to cancel two hardware timers while holding spinlocks that those same timers need to acquire. On multi-processor systems, this creates a circular wait condition where the main thread blocks waiting for timer callbacks to finish, while the timer callbacks block trying to acquire locks held by the main thread. The vulnerability was discovered through source code review rather than active exploitation.

• CVE-2026-53204MEDIUM 5.5

  The Linux kernel's Stratix10 RSU (Remote System Update) firmware driver contains a NULL pointer dereference vulnerability that can crash the system. When certain initialization messages time out during driver probe, the code incorrectly frees the communication channel but then tries to send additional messages on that same freed channel. The next kernel thread to run will crash when it attempts to access the freed channel structure. This is a local denial-of-service issue affecting systems with Intel Stratix10 hardware.

• CVE-2026-53206MEDIUM 5.5

  A flaw in the Linux kernel's Intel VPU (Video Processing Unit) driver fails to validate memory boundaries when loading firmware images. An attacker with local system access could craft a malicious firmware image with incorrect memory specifications, causing the kernel to attempt invalid memory allocation or access operations. This leads to a denial of service condition where the system or the affected driver becomes unavailable.

• CVE-2026-53207MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's memory failure handling code, specifically in how it manages hardware-poisoned huge pages. When two processes simultaneously call madvise(MADV_HWPOISON) on the same huge page while another thread unmaps the page, the kernel attempts to acquire the same spinlock twice, causing the system to hang. This is a kernel-level concurrency bug that requires local system access to trigger.

• CVE-2026-53208MEDIUM 5.5

  A flaw in the Linux kernel's Bluetooth BR/EDR (Basic Rate/Enhanced Data Rate) stack allows an unpaired attacker within radio range to trigger a denial-of-service condition. The vulnerability exists in the L2CAP (Logical Link Control and Adaptation Protocol) signaling layer, which fails to enforce the minimum packet size limit (MTUsig = 48 bytes) for Bluetooth signaling commands. An attacker can craft a single oversized signaling packet containing many ECHO_REQ (echo request) commands, forcing the target device to respond with numerous ECHO_RSP (echo response) frames, consuming bandwidth and processing resources without authentication.

• CVE-2026-53210MEDIUM 5.5

  CVE-2026-53210 is a memory leak vulnerability in the Linux kernel's TEE (Trusted Execution Environment) shared memory handler. When a user attempts to register shared memory with zero length via the TEE_IOC_SHM_REGISTER ioctl, the kernel allocates memory but fails to free it before exiting the error path, causing the allocated memory to leak. While the immediate impact is resource exhaustion rather than data exposure or privilege escalation, repeated triggering can degrade system stability on TEE-enabled systems.

• CVE-2026-53211MEDIUM 5.5

  A flaw in the Linux kernel's netfilter module causes uninitialized kernel memory to leak when certain network filtering rules access bridge device hardware addresses. When a netfilter rule requests the hardware address of an incoming interface on a bridge, the kernel writes only 6 bytes of the address into a register that is 8 bytes long, leaving 2 bytes of stale stack memory exposed. If a rule subsequently reads from that register, the uninitialized kernel data can be disclosed to a user-space application. The fix involves zeroing the full register before writing the hardware address.

• CVE-2026-53213MEDIUM 5.5

  A memory leak vulnerability exists in the Linux kernel's Direct Rendering Manager (DRM) video core (vc4) driver. The issue occurs when the krealloc() function is called to resize allocated memory without properly checking its return value before overwriting the original pointer. If krealloc() fails and returns NULL, the original memory block becomes unreachable and is leaked. An unprivileged local user could trigger this condition repeatedly, exhausting system memory and causing a denial of service.

• CVE-2026-53214MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's IPv6 address configuration handling. When the kernel removes an IPv6 address, it attempts to clean up associated routing table entries. In certain conditions, it can reference a sentinel entry (a placeholder used internally) that lacks a valid routing table pointer, causing the kernel to crash. This affects local users with appropriate privileges and results in a denial-of-service condition. The vulnerability requires local access and appropriate user capabilities to trigger.

• CVE-2026-53218MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem allows a local, unprivileged user to trigger a condition where uninitialized memory is exposed through network packet filtering rules. When a specific flag (F_PRESENT) is used in netfilter extended header matching, the kernel incorrectly tracks which register storage areas have been written to, leaving portions of kernel stack memory accessible. This can lead to information disclosure or system instability.

• CVE-2026-53219MEDIUM 5.5

  A flaw in the Linux kernel's netfilter subsystem allows unprivileged local users to extract internal memory pointers used for performance counters. When retrieving firewall rule information, the kernel temporarily exposes the raw address of a per-CPU memory allocation before replacing it with sanitized data. If a user-space program causes a memory fault at precisely the right moment during this window, the raw pointer leaks out, potentially revealing kernel memory layout details that aid further exploitation.

• CVE-2026-53220MEDIUM 5.5

  A vulnerability in the Linux kernel's netfilter bridge module can cause a system crash when network packets are reinjected through the NFQUEUE mechanism after a bridge port has been removed or reassigned. The kernel fails to properly validate whether a bridge port still exists before attempting to process redirected traffic, leading to a null pointer dereference. While the immediate trigger requires local access and specific timing (removing a port between initial packet hook and reinject), the underlying validation gap represents a stability risk for systems relying on bridged network filtering.

• CVE-2026-53222MEDIUM 5.5

  A resource management issue exists in the Linux kernel's PTP (Precision Time Protocol) OCP driver. When the driver is unloaded, it frees pin resources before properly unregistering the PTP clock device. A recent kernel change causes the unregister process to reconfigure those already-freed pins, creating a use-after-free condition that can crash the system. The fix reorders operations so the clock is unregistered before pin resources are released, and ensures interrupt handlers are fully synchronized before cleanup.

• CVE-2026-53226MEDIUM 5.5

  A flaw in the Linux kernel's Rockchip GPIO driver causes memory and resource leaks when the driver is unloaded. Specifically, interrupt-handling structures allocated during driver initialization are not properly freed during removal. These orphaned structures remain registered globally and can be accessed by system callbacks after the hardware driver has already shut down, risking a crash. The fix requires explicitly cleaning up these structures before the driver fully unloads.

• CVE-2026-53227MEDIUM 5.5

  A memory management bug exists in the Linux kernel's Open vSwitch networking subsystem. When a network packet buffer fails to allocate during certain locking operations, the kernel attempts to free an invalid memory pointer, causing a crash. This vulnerability affects systems running vulnerable kernel versions, particularly in environments using Open vSwitch for virtualized networking.

• CVE-2026-53231MEDIUM 5.5

  A deadlock vulnerability exists in the Linux kernel's network PHY (physical layer) driver code. When the kernel uses its generic PHY driver (genphy) with SFP cage modules (small form-factor pluggable optical transceivers), an initialization sequence can cause the system to hang. The issue stems from improper handling of SFP bus setup under the RTNL (Real-Time NetLink) lock, which genphy acquires during probing but other PHY drivers do not. Systems attempting to initialize SFP cages through genphy will experience a complete deadlock, rendering network functionality unavailable until the system is restarted.

• CVE-2026-53236MEDIUM 5.5

  A vulnerability in the Linux kernel allows unprivileged users to attach Berkeley Packet Filter (cBPF) rules to TCP sockets in a way that could leak sensitive TCP connection information such as sequence and acknowledgment numbers. The fix restricts this socket option to only users with administrative network privileges (CAP_NET_ADMIN), preventing unprivileged applications from exploiting this side-channel to extract data about active TCP connections.

• CVE-2026-53237MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's mvebu GPIO driver during system suspend and resume operations. The driver unconditionally calls PWM-related suspend and resume functions for all GPIO banks, but not all banks have PWM functionality. When a GPIO bank without PWM is processed, the code attempts to access memory through a NULL pointer, causing the system to crash. This vulnerability can be triggered by any user with local access to initiate a system suspend, making it a straightforward denial-of-service condition on affected systems.

• CVE-2026-53238MEDIUM 5.5

  A flaw in the Linux kernel's network labeling subsystem allows a local attacker with user-level privileges to trigger an out-of-bounds memory read. The vulnerability stems from incomplete validation when processing network configuration requests—specifically, the code checks the length of an IP address field but fails to validate the corresponding network mask field in the same way. An attacker can craft a malicious request that provides a properly-formatted address but a deliberately short mask, causing the kernel to read beyond the mask field's actual size and access uninitialized memory. This leads to a denial of service through a kernel crash.

• CVE-2026-53241MEDIUM 5.5

  The Linux kernel's ALSA (Advanced Linux Sound Architecture) sequencer contains a memory access vulnerability in its dummy port implementation. When the dummy sequencer port processes Unified MIDI Protocol (UMP) events, it copies event data into a temporary buffer that is sized for legacy events rather than the larger UMP event format. This causes the system to read beyond the buffer's actual size when forwarding the event to subscribers, potentially causing a kernel crash or information leak. The issue affects systems using ALSA's sequencer functionality with UMP event handling enabled.

• CVE-2026-53243MEDIUM 5.5

  A bug in the Linux kernel's rseq (restartable sequences) subsystem allows an uninitialized stack variable to be read and potentially leaked to userspace. The issue stems from how the C compiler evaluates the initialization of a local structure; it may read from the `ids.cpu_id` field before that field has been assigned a value, causing kernel memory to be exposed. This is a local privilege escalation risk affecting Linux systems where unprivileged users can trigger the vulnerable code path.

• CVE-2026-53245MEDIUM 5.5

  A parsing bug in the Linux kernel's Media Redundancy Protocol (MRP) implementation can cause the network stack to misinterpret protocol frames. The vulnerability occurs in how the kernel parses vector attribute fields within MRP Protocol Data Units (PDUs). When processing event sequences, the parser fails to correctly track its position in some cases—particularly when the number of events is a multiple of three, or when certain optional fields are present or absent. This can lead to the kernel applying spurious state changes to MRP applicant state machines or corrupting the offset used to parse subsequent protocol data, potentially triggering a denial of service.

• CVE-2026-53249MEDIUM 5.5

  CVE-2026-53249 addresses a privilege escalation and information disclosure risk in the Linux kernel related to IPv4 source routing options. The vulnerability stems from a lack of proper access controls on the LSRR (Loose Source and Record Route) and SSRR (Strict Source and Record Route) IP options, which allow unprivileged users to craft packets that traverse arbitrary network paths. An attacker with local access could exploit this to force traffic through controlled nodes, potentially revealing sensitive TCP sequence numbers and other protocol state information. The fix restricts these options to applications with CAP_NET_RAW capability, ensuring only privileged processes can use them.

• CVE-2026-53251MEDIUM 5.5

  A memory management flaw exists in the Linux kernel's Bluetooth ISO (Isochronous) connection handling. When the kernel routes Bluetooth ISO connections, it obtains a reference to a device object but fails to release it when the connection synchronization function exits, either normally or due to an error. This causes the reference count to remain elevated, potentially preventing the device from being properly cleaned up and leading to resource exhaustion over time.

• CVE-2026-53252MEDIUM 5.5

  A memory leak has been discovered in the Linux kernel's Bluetooth HCI subsystem. When Bluetooth device initialization fails early in the startup process, before the device is fully registered, a cleanup function is incorrectly skipped. This leaves behind unreleased memory from the SRCU (Sleepable RCU) synchronization mechanism, which accumulates per-CPU allocations that are never freed. While the leak itself doesn't directly compromise data confidentiality or integrity, repeated device failures can exhaust available memory and degrade system stability or cause denial of service.

• CVE-2026-53257MEDIUM 5.5

  A vulnerability in the Linux kernel's WiFi configuration system (cfg80211) can cause the system to crash when certain advanced WiFi capability settings are inconsistent. Specifically, if Extended HE (EHT) capability information is present but the corresponding operational data is missing, the kernel may fail. This is a local vulnerability requiring an authenticated user on the system to trigger.

• CVE-2026-53258MEDIUM 5.5

  A memory leak exists in the Linux kernel's WiFi scanning code that occurs when 6 GHz band scanning fails. When cfg80211_scan() encounters an error during split 6 GHz scanning, the kernel allocates memory for an internal scan request (rdev->int_scan_req) but fails to properly release it. This happens because the cleanup function checks for rdev->scan_req being populated before freeing resources, but in this error condition both pointers end up NULL, causing the allocated memory to never be released. The leak is triggered through normal WiFi scanning operations, typically initiated by user-space tools like wpa_supplicant.

• CVE-2026-53261MEDIUM 5.5

  A memory leak exists in the Linux kernel's devlink subsystem where relationship state is not properly released in certain failure scenarios. Specifically, when a device driver (particularly SubFunction or SF drivers) creates a nested devlink relationship to its parent before completing registration, and then fails during the probe process, the relationship reference is leaked because the normal cleanup path is bypassed. This affects only systems where drivers follow this specific initialization pattern and experience probe failures.

• CVE-2026-53263MEDIUM 5.5

  A memory handling error in the Linux kernel's 6LoWPAN implementation—a compression protocol for IPv6 traffic over low-power wireless networks—causes two problems: it corrupts compressed multicast addresses by overwriting a required identifier field, and it leaks uninitialized kernel memory over the network. The vulnerability is triggered during the compression of IPv6 multicast addresses and affects systems that use 6LoWPAN for IoT or embedded network communication.

• CVE-2026-53269MEDIUM 5.5

  The Linux kernel's netfilter synproxy feature can experience a race condition when multiple processes simultaneously attempt to register network hooks. This occurs because the infrastructure registers these hooks on-demand when users add iptables targets or nftables expressions concurrently, without proper synchronization. A fix has been implemented by introducing a mutex (mutual exclusion lock) to serialize access to the reference counting mechanism, preventing the race condition from occurring.

• CVE-2026-53271MEDIUM 5.5

  A flaw in the Linux kernel's ksmbd server allows a local user to crash the system by exploiting a race condition in how the server handles SMB (Samba/Windows file-sharing) connections. When a client disconnects while the server is processing certain file-locking notifications, the server can attempt to dereference a NULL pointer, triggering a kernel panic. An authenticated local user with minimal privileges can reliably trigger this denial-of-service condition.

• CVE-2026-53274MEDIUM 5.5

  A flaw in the Linux kernel's SMC (Shared Memory Communications) socket implementation allows a local attacker without special privileges to freeze kernel worker threads and trigger system instability. By exploiting how the kernel copies user-provided socket settings, an attacker can intentionally stall the copy operation—using specialized memory tricks—while holding a critical lock. This causes other kernel operations to hang indefinitely, eventually triggering watchdog alerts and system degradation. The fix relocates the vulnerable copy operation outside the locked section.

• CVE-2026-53278MEDIUM 5.5

  A null pointer dereference vulnerability exists in the Linux kernel's ARM MPAM (Memory Partitioning And Monitoring) subsystem. The issue occurs in the __destroy_component_cfg() function, which attempts to free memory structures without first checking whether those structures were actually allocated. If this function is called during system shutdown or component disable before initialization completes, the kernel attempts to access memory that doesn't exist, causing a crash. This is a local availability issue that requires prior system access to trigger.

• CVE-2026-53279MEDIUM 5.5

  A flaw in the Linux kernel's graphics driver for certain Intel graphics hardware can cause the system to hang during initialization when specific error conditions occur. The issue stems from improper cleanup of I2C adapters—hardware communication channels—when the LVDS display initialization fails. Rather than correctly tracking which adapters were created locally versus borrowed from elsewhere, the code attempts to shut down all adapters indiscriminately, leading to a deadlock.

• CVE-2026-53280MEDIUM 5.5

  A flaw in the Linux kernel's IOMMU (Input/Output Memory Management Unit) subsystem can cause the system to crash when PCI device reset operations are performed after a default domain allocation fails during initial device probe. The vulnerability stems from code attempting to re-attach a device to a domain without first checking whether the domain pointer is valid, leading to a null pointer dereference. This is a local issue requiring user-level privileges to trigger.

• CVE-2026-53282MEDIUM 5.5

  A flaw in the Linux kernel's kexec mechanism can cause the purgatory code (a small runtime environment used during kernel replacement) to crash when attempting to access memory it expects to find on the stack. This occurs specifically in non-jump kexec operations, where a recent kernel change removed stack setup that purgatory still depends on. The crash can disrupt system reboots or kernel updates that rely on kexec, though the impact is limited to local denial of service.

• CVE-2026-53283MEDIUM 5.5

  CVE-2026-53283 is a memory bounds-checking flaw in the Linux kernel's AMD IOMMU driver. When the system probes PCI devices during boot, the driver looks up which IOMMU manages each device using a lookup table indexed by device ID. For devices not described in the system's IOMMU configuration (IVRS), the driver reads past the end of the lookup table before verifying the device ID is valid. In recent kernel versions where the lookup table is tightly allocated, this out-of-bounds read retrieves adjacent kernel memory that gets incorrectly interpreted as a pointer, causing a crash. The vulnerability is triggered during system initialization and affects AMD-based virtualized environments where the IOMMU configuration is incomplete or restrictive.

• CVE-2026-53285MEDIUM 5.5

  CVE-2026-53285 is a kernel crash vulnerability in AMD's display driver (DCN32) on Linux systems. When the driver attempts to allocate memory for a phantom plane during bandwidth validation, it triggers a kernel panic because the memory allocation happens in a context where interrupts are disabled. This affects systems using AMD display hardware with the affected kernel versions. The crash is triggered locally by a privileged user and results in a denial of service.

• CVE-2026-53287MEDIUM 5.5

  A bug in the Linux kernel's audit logging system incorrectly records capability information when processes change their permissions. When a program modifies its inheritable capabilities—a mechanism used to control privilege escalation during program execution—the audit log incorrectly shows the effective capabilities instead of the inheritable ones. This means attackers could modify a process's inheritable capabilities in preparation for privilege escalation without leaving a clear trace in the audit trail, defeating the purpose of compliance and forensic monitoring. The flaw has existed since 2008.

• CVE-2026-53288MEDIUM 5.5

  A memory mapping issue in the Linux kernel's ARM64 architecture can cause the kernel's data segment to overflow into a reserved gap page during early boot initialization. This happens because the kernel's page table setup doesn't reserve enough space to handle the additional memory splits required when mapping certain kernel regions with different access permissions. The overflow can corrupt the early initialization stack, potentially causing the system to crash or behave unpredictably during boot or shortly thereafter.

• CVE-2026-53289MEDIUM 5.5

  A flaw in the Linux kernel's ice network driver can cause the system to crash when resetting all virtual functions (VFs) during firmware updates. The driver fails to properly check whether a critical rebuild operation succeeded, then proceeds to access memory structures that were never initialized, resulting in a NULL pointer dereference. The crash occurs in kernel code, affecting systems running affected kernel versions with ice-based network hardware.

• CVE-2026-53291MEDIUM 5.5

  The Linux kernel's Conexant audio driver does not properly validate error conditions when initializing jack detection during device probing. When the jack detection setup fails—for example, due to memory pressure—the driver ignores the error and continues as if initialization succeeded. This creates a window where the kernel may later crash when audio jack events occur or the driver tries to access uninitialized data structures. The issue arises because the developer did not use proper error-checking macros (IS_ERR/PTR_ERR) on the function return value.

• CVE-2026-53292MEDIUM 5.5

  A vulnerability in the Linux kernel's Phonet networking subsystem can crash a system when a local user sends data through a Phonet socket that has never been properly bound. The vulnerability exists because the kernel attempts to automatically bind an unbound socket, but when that binding fails, the code incorrectly assumes the socket was already bound to an address and crashes instead of handling the error gracefully. This is a local denial-of-service issue accessible to unprivileged users.

• CVE-2026-53293MEDIUM 5.5

  A concurrency control bug in the Linux kernel's AMD GPU driver can cause system crashes or hangs. The issue stems from incorrect lock ordering and improper memory allocation patterns that can deadlock the kernel when reading GPU memory-mapped registers. A local attacker with standard user privileges can trigger the denial of service without requiring special access or user interaction.

• CVE-2026-53295MEDIUM 5.5

  A vulnerability in the Linux kernel's mailbox subsystem can cause the system to crash (an 'OOPS') if a mailbox controller is initialized without a properly attached channel array. The issue stems from missing validation that checks whether the channel array exists before the code attempts to use it. Because mailbox controllers can start very early in the boot process, this crash may occur before logging systems are fully active, making it harder to diagnose. A fix adds a sanity check to gracefully fail if the channel array is missing, preventing the crash.

• CVE-2026-53297MEDIUM 5.5

  A flaw in the Linux kernel's Azure Ethernet driver (MANA) can cause the system to crash if device resume fails during power management operations. When the driver attempts to recover from a failed resume, it cleans up resources and sets internal pointers to NULL. However, if the device is later disconnected, the driver's removal code runs again without checking whether those pointers are already NULL, leading to a null pointer dereference and kernel panic. This is a reliability issue that affects system stability on affected Azure hardware.

• CVE-2026-53298MEDIUM 5.5

  A flaw in the Linux kernel's Airoha network driver can cause the system to crash when the driver fails to properly initialize network queues during startup. The problem occurs because the driver marks a queue as initialized before it has actually finished setting up all the necessary memory structures. If something goes wrong during this initialization, the cleanup code assumes the queue is fully ready and tries to access memory that doesn't exist, crashing the kernel. This is a local vulnerability that requires an attacker to already have user-level access to the system.

• CVE-2026-53299MEDIUM 5.5

  A flaw in the Linux kernel's Airoha network driver can cause the system to crash if network queue initialization fails. The vulnerability stems from premature initialization of a queue descriptor counter; when the driver attempts to clean up after a failed allocation, it tries to access memory that was never properly set up, triggering a crash. The fix moves the counter initialization to occur only after all critical setup steps succeed, ensuring cleanup only happens on fully initialized state.

• CVE-2026-53301MEDIUM 5.5

  A Linux kernel vulnerability in the Amlogic T7 reset driver can cause the system to crash when the reset subsystem is accessed. The issue stems from missing reset operations that lead to a null pointer dereference—essentially, the kernel tries to use a feature that hasn't been properly initialized. While the T7 reset functionality isn't currently active in most deployments, this defect becomes dangerous if the reset system is enabled or if future kernel updates activate this code path. The vulnerability requires local access to trigger, limiting its immediate blast radius, but the outcome is a denial of service that could bring down affected systems.

• CVE-2026-53302MEDIUM 5.5

  A flaw in the Linux kernel's EIP93 cryptographic hardware driver causes the system to crash when setting up HMAC encryption keys. The driver attempts to use a temporary encryption tool that doesn't exist because it's looking for the wrong type of algorithm—specifically excluding the async (asynchronous) algorithms that the driver actually provides. When this lookup fails, the encryption setup process leaves critical data uninitialized, and the next time the system tries to use that encryption setup, it crashes trying to access memory that was never properly configured. The vulnerability requires local access and authenticated user privileges to trigger.

• CVE-2026-53304MEDIUM 5.5

  A vulnerability in the Linux kernel's SCSI generic (sg) driver allows a local attacker with sufficient privileges to trigger a system hang by setting an invalid module parameter. The issue occurs when the def_reserved_size parameter is set to an out-of-range value (like -1) and then a SCSI device file is opened, causing the kernel to enter an infinite loop that freezes the CPU. This is a denial-of-service vulnerability requiring local access to exploit.

• CVE-2026-53305MEDIUM 5.5

  A flaw in the Linux kernel's USB Type-C PS8833x retimer driver can cause the system to crash when a user unbinds the device from its driver—for example, when attempting to reassign it to a virtualization framework. The crash occurs because the driver's cleanup routine tries to access driver data that was never properly initialized during device startup. This is a memory corruption issue (null pointer dereference) that affects local users with sufficient privileges.

• CVE-2026-53306MEDIUM 5.5

  A boundary error in the Linux kernel's hvc_iucv (IUCV hypervisor console) driver allows a local attacker to trigger an out-of-bounds memory access. The vulnerability stems from inconsistent bounds checking when managing virtual console devices. When the device counter reaches its maximum value of 8, the code can attempt to access an array element beyond its allocated range, potentially causing a kernel crash or memory corruption.

• CVE-2026-53307MEDIUM 5.5

  A flaw exists in the Linux kernel's pinctrl subsystem where device tree configuration parsing can crash the system. When a device tree specifies an empty 'pinmux' property, the kernel fails to validate this condition, leading to memory access errors. An attacker with local access could exploit this to trigger a denial-of-service condition by crafting a malicious device tree or pinctrl configuration.

• CVE-2026-53308MEDIUM 5.5

  A memory management flaw exists in the Linux kernel's max77705 power supply driver. The driver fails to properly clean up a work queue when the module is removed, causing a memory leak. Additionally, the order in which components are initialized and destroyed creates a race condition: if an interrupt fires after the work queue is destroyed but before the interrupt handler is cleaned up, the handler will attempt to schedule work on freed memory, potentially causing a system crash. The vulnerability requires local access and elevated privileges to trigger.

• CVE-2026-53310MEDIUM 5.5

  CVE-2026-53310 is a kernel memory access bug in Linux that affects Tegra-based systems (NVIDIA's ARM processors commonly used in mobile devices and embedded platforms). When the system encounters an error on one fabric (a subsystem interconnect), it incorrectly tries to read error information from a different fabric's memory location, causing a crash. The vulnerability requires local access to trigger and results in a denial of service—an attacker with a user account on the device could crash the kernel.

• CVE-2026-53311MEDIUM 5.5

  A vulnerability exists in the Linux kernel's FUSE (Filesystem in Userspace) subsystem where uninitialized memory is read when revalidating directory entries. Specifically, the `fuse_dentry_revalidate()` function accesses a timestamp field that may not have been set during dentry allocation, causing the kernel to use garbage values from memory. This can lead to denial of service through kernel crashes or undefined behavior. The issue is triggered during file open operations when the kernel creates new directory cache entries without properly initializing all fields.

• CVE-2026-53312MEDIUM 5.5

  A vulnerability in the Linux kernel's RISC-V IOMMU (input/output memory management unit) code can cause the system to enter an infinite loop during memory invalidation operations. The issue stems from improper overflow handling when processing page table invalidation requests. If a legitimately configured invalidation request specifies an end address at the maximum value the system can represent, the code fails to handle this edge case correctly, resulting in a denial of service condition where the kernel becomes unresponsive.

• CVE-2026-53313MEDIUM 5.5

  CVE-2026-53313 is a NULL pointer dereference vulnerability in the Linux kernel's AMD display driver (DRM/AMD). Two error-handling functions in the display management code attempt to log error messages without first verifying that a critical object is valid, risking a kernel crash. The vulnerability requires local access and occurs only in error paths, but when triggered, it can cause a denial of service. The fix involves reordering validation checks to ensure the object is safe before any code that depends on it runs.

• CVE-2026-53314MEDIUM 5.5

  A flaw in the Linux kernel's CPU hotplug subsystem can cause the system to report an error and potentially fail to properly shut down CPUs. The issue stems from improper callback ordering in the padata (parallel data) module—specifically, the CPU offline callback was registered in a section that forbids failure, but the callback itself can fail. Moving this callback to a section that permits failure resolves the condition and prevents false warnings during CPU power transitions.

• CVE-2026-53315MEDIUM 5.5

  A coding flaw in the Linux kernel's AMD Radeon driver can cause the system to crash if a function called ras_core_get_utc_second_timestamp() is invoked with an invalid or missing input. This function is responsible for recording timestamps when hardware reliability errors occur. The code checks whether the input is valid before using it, but then tries to log an error message using that same potentially invalid input, creating a window for a NULL pointer crash. The fix adds an upfront validation step to catch the problem earlier and exit gracefully.

• CVE-2026-53316MEDIUM 5.5

  A NULL pointer dereference vulnerability exists in the Linux kernel's AMD RAS (Reliability, Availability, and Serviceability) driver. When the ras_core object is NULL, the error handling path attempts to access ras_core->dev, causing a kernel panic. This can be triggered by a local attacker with standard user privileges, resulting in a denial of service that crashes the system or services dependent on the affected driver.

• CVE-2026-53317MEDIUM 5.5

  A flaw in the Linux kernel's MediaTek MT7921 WiFi driver causes the firmware to crash when a WiFi access point assigns a station ID number higher than 20. Under normal circumstances, this doesn't occur because most access point software starts numbering stations from 1 and enforces reasonable limits on the number of connected devices. However, with modified versions of access point software (like a customized variant of hostapd), stations can be assigned much higher ID numbers—such as starting at 65—which triggers a firmware crash. The issue affects only access point mode on MT7922 hardware; regular client mode connections are unaffected.

• CVE-2026-53318MEDIUM 5.5

  A flaw in the Linux kernel's WiFi driver for MediaTek MT7925 chipsets can crash the system when certain network operations occur. The vulnerability stems from the driver checking a pointer after already using it, rather than checking first. An attacker with local system access could trigger this crash by performing specific wireless transmission activities, resulting in a denial of service. This is a kernel-level issue affecting machines that use MT7925 WiFi adapters.

• CVE-2026-53319MEDIUM 5.5

  CVE-2026-53319 is a Linux kernel issue in the block I/O writeback throttling (wbt) subsystem. The vulnerability stems from overly aggressive warning checks that trigger during normal, recoverable error conditions—specifically when memory allocation fails or when writeback throttling is already registered. These situations are expected and harmless, but the kernel's WARN_ON_ONCE macro was generating spurious warnings that could be weaponized by attackers or malicious tools to flood kernel logs. The fix replaces those warnings with silent error handling, allowing the system to gracefully degrade to operating without writeback throttling when initialization fails, which poses no functional risk.