CVE-2025-39810

bnxt_en: Fix memory corruption when FW resources change during ifdown

7.8 HighFix available

What does this mean?

: 7.8v3.1, from CVE List
: 0.20%9th percentile
Fixed in: 6.1.191-r0linux-lts
Published: September 16, 2025
Modified: November 11, 2026
Weakness: CWE-787
Also known as: AZL-67431AZL-71206BELL-CVE-2025-39810CLSA-2026-1771081379CLSA-2026-1772815097CLSA-2026-1786761805CLSA-2026-1789141176CLSA-2026-1791852988
Show 41 moreShow less
CLSA-2026-1791858083DEBIAN-CVE-2025-39810DSA-6008-1EUVD-2025-29604GHSA-rv8g-6vr7-cv64OESA-2025-2776OESA-2025-2802OESA-2025-2803ROOT-OS-DEBIAN-11-CVE-2025-39810ROOT-OS-DEBIAN-12-CVE-2025-39810ROOT-OS-UBUNTU-2204-CVE-2025-39810ROOT-OS-UBUNTU-2404-CVE-2025-39810SUSE-SU-2025:03600-1SUSE-SU-2025:03634-1SUSE-SU-2025:20851-1SUSE-SU-2025:20861-1SUSE-SU-2025:20870-1SUSE-SU-2025:20898-1SUSE-SU-2025:21074-1SUSE-SU-2025:21139-1SUSE-SU-2025:21179-1SUSE-SU-2025:3751-1SUSE-SU-2025:4057-1SUSE-SU-2025:4132-1SUSE-SU-2025:4141-1SUSE-SU-2026:20560-1UBUNTU-CVE-2025-39810USN-8095-1USN-8095-2USN-8095-3USN-8095-4USN-8095-5USN-8100-1USN-8125-1USN-8126-1USN-8165-1USN-8261-1USN-8961-1USN-8962-1USN-8963-1openSUSE-SU-2025:20081-1

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings().

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.20%Up 0.2 points since Sep 17, 2025

What each source reports

CVE List Score used7.8

bnxt_en: Fix memory corruption when FW resources change during ifdown

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

EUVDEUVD-2025-296047.8

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: EUVD-2025-29604
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-rv8g-6vr7-cv647.8

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory...

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: GHSA-rv8g-6vr7-cv64
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

NVD7.8

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-787
Updated: 2026-11-02

OSVBELL-CVE-2025-398107.8

Record: BELL-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

OSV7.8

bnxt_en: Fix memory corruption when FW resources change during ifdown

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 45 moreShow less

OSVDEBIAN-CVE-2025-398107.8

In the Linux kernel, the following vulnerability has been resolved: bnxt_en: Fix memory corruption when FW resources change during ifdown bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1. In the FW resource or capability change scenario, the FW will return flags in bnxt_hwrm_if_change() that will cause the driver to reinitialize and call bnxt_cancel_reservations(). This will lead to bnxt_init_dflt_ring_mode() calling bnxt_set_dflt_rings() and bp->num_tc may be greater than 1. This will cause bp->tx_ring[] to be sized too small and cause memory corruption in bnxt_alloc_cp_rings(). Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: DEBIAN-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-27767.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

jfs: add check read-only before txBeginAnon() call

Added a read-only check before calling txBeginAnon in extAlloc and extRecord. This prevents modification attempts on a read-only mounted filesystem, avoiding potential errors or crashes.

Call trace: txBeginAnon+0xac/0x154 extAlloc+0xe8/0xdec fs/jfs/jfs_extent.c:78 jfs_get_block+0x340/0xb98 fs/jfs/inode.c:248 __block_write_begin_int+0x580/0x166c fs/buffer.c:2128 __block_write_begin fs/buffer.c:2177 [inline] block_write_begin+0x98/0x11c fs/buffer.c:2236 jfs_write_begin+0x44/0x88 fs/jfs/inode.c:299(CVE-2024-58095)

In the Linux kernel, the following vulnerability has been resolved:

mm: zswap: properly synchronize freeing resources during CPU hotunplug

In zswap_compress() and zswap_decompress(), the per-CPU acomp_ctx of the current CPU at the beginning of the operation is retrieved and used throughout. However, since neither preemption nor migration are disabled, it is possible that the operation continues on a different CPU.

If the original CPU is hotunplugged while the acomp_ctx is still in use, we run into a UAF bug as some of the resources attached to the acomp_ctx are freed during hotunplug in zswap_cpu_comp_dead() (i.e. acomp_ctx.buffer, acomp_ctx.req, or acomp_ctx.acomp).

The problem was introduced in commit 1ec3b5fe6eec ("mm/zswap: move to use crypto_acomp API for hardware acceleration") when the switch to the crypto_acomp API was made. Prior to that, the per-CPU crypto_comp was retrieved using get_cpu_ptr() which disables preemption and makes sure the CPU cannot go away from under us. Preemption cannot be disabled with the crypto_acomp API as a sleepable context is needed.

Use the acomp_ctx.mutex to synchronize CPU hotplug callbacks allocating and freeing resources with compression/decompression paths. Make sure that acomp_ctx.req is NULL when the resources are freed. In the compression/decompression paths, check if acomp_ctx.req is NULL after acquiring the mutex (meaning the CPU was offlined) and retry on the new CPU.

The initialization of acomp_ctx.mutex is moved from the CPU hotplug callback to the pool initialization where it belongs (where the mutex is allocated). In addition to adding clarity, this makes sure that CPU hotplug cannot reinitialize a mutex that is already locked by compression/decompression.

Previously a fix was attempted by holding cpus_read_lock() [1]. This would have caused a potential deadlock as it is possible for code already holding the lock to fall into reclaim and enter zswap (causing a deadlock). A fix was also attempted using SRCU for synchronization, but Johannes pointed out that synchronize_srcu() cannot be used in CPU hotplug notifiers [2].

Alternative fixes that were considered/attempted and could have worked:

Refcounting the per-CPU acomp_ctx. This involves complexity in handling the race between the refcount dropping to zero in zswap_[de]compress() and the refcount being re-initialized when the CPU is onlined.
Disabling migration before getting the per-CPU acomp_ctx [3], but that's discouraged and is a much bigger hammer than needed, and could result in subtle performance issues.

[1]https://lkml.kernel.org/(CVE-2025-21693)

In the Linux kernel, the following vulnerability has been resolved:

memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove

This fixes the following crash:

================================================================== BUG: KASAN: slab-use-after-free in rtsx_usb_ms_poll_card+0x159/0x200 [rtsx_usb_ms] Read of size 8 at addr ffff888136335380 by task kworker/6:0/140241

CPU: 6 UID: 0 PID: 140241 Comm: kworker/6:0 Kdump: loaded Tainted: G E 6.14.0-rc6+ #1 Tainted: [E]=UNSIGNED_MODULE Hardware name: LENOVO 30FNA1V7CW/1057, BIOS S0EKT54A 07/01/2024 Workqueue: events…

Record: OESA-2025-2776
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-28027.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nfc: nci: Fix uninit-value in nci_rx_work

syzbot reported the following uninit-value access issue [1]

nci_rx_work() parses received packet from ndev->rx_q. It should be validated header size, payload size and total packet size before processing the packet. If an invalid packet is detected, it should be silently discarded.(CVE-2024-38381)

In the Linux kernel, the following vulnerability has been resolved:net: ti: icssg_prueth: Fix NULL pointer dereference in prueth_probe()In the prueth_probe() function, if one of the calls to emac_phy_connect()fails due to of_phy_connect() returning NULL, then the subsequent call tophy_attached_info() will dereference a NULL pointer.Check the return code of emac_phy_connect and fail cleanly if there is anerror.(CVE-2024-38584)

In the Linux kernel, the following vulnerability has been resolved:cpufreq: exit() callback is optionalThe exit() callback is optional and shouldn t be called without checkinga valid pointer first.Also, we must clear freq_table pointer even if the exit() callback isn tpresent.(CVE-2024-38615)

In the Linux kernel, the following vulnerability has been resolved:serial: max3100: Update uart_driver_registered on driver removalThe removal of the last MAX3100 device triggers the removal ofthe driver. However, code doesn t update the respective globalvariable and after insmod — rmmod — insmod cycle the kerneloopses: max3100 spi-PRP0001:01: max3100_probe: adding port 0 BUG: kernel NULL pointer dereference, address: 0000000000000408 ... RIP: 0010:serial_core_register_port+0xa0/0x840 ... max3100_probe+0x1b6/0x280 [max3100] spi_probe+0x8d/0xb0Update the actual state so next time UART driver will be registeredagain.Hugo also noticed, that the error path in the probe also affectedby having the variable set, and not cleared. Instead of clearing itmove the assignment after the successfull uart_register_driver() call.(CVE-2024-38633)

In the Linux kernel, the following vulnerability has been resolved:

enic: Validate length of nl attributes in enic_set_vf_port

enic_set_vf_port assumes that the nl attribute IFLA_PORT_PROFILE is of length PORT_PROFILE_MAX and that the nl attributes IFLA_PORT_INSTANCE_UUID, IFLA_PORT_HOST_UUID are of length PORT_UUID_MAX. These attributes are validated (in the function do_setlink in rtnetlink.c) using the nla_policy ifla_port_policy. The policy defines IFLA_PORT_PROFILE as NLA_STRING, IFLA_PORT_INSTANCE_UUID as NLA_BINARY and IFLA_PORT_HOST_UUID as NLA_STRING. That means that the length validation using the policy is for the max size of the attributes and not on exact size so the length of these attributes might be less than the sizes that enic_set_vf_port expects. This might cause an out of bands read access in the memcpys of the data of these attributes in enic_set_vf_port.(CVE-2024-38659)

In the Linux kernel, the following vulnerability has been resolved:riscv: prevent pt_regs corruption for secondary idle threadsTop of the kernel thread stack should be reserved for pt_regs. Howeverthis is not the case for the idle threads of the secondary boot harts.Their stacks overlap with their pt_regs, so both may get corrupted.Similar issue has been fixed for the primary hart, see c7cdd96eca28( riscv: prevent stack corruption by reserving task_pt_regs(p) early ).However that fix was not propagated to the secondary harts. The problemhas been noticed in some CPU hotplug tests with V enabled. The functionsmp_callin stored several registers on stack, corrupting top of pt_regsstructure including status field. As a result, kernel attempted to saveor restore inexistent V context.(CVE-2024-38667)

In the Linux kernel, the following vulnerability has been resolved:jfs: xattr: fix buffer overflow for invalid xattrWhen an xattr size is not what is expected, it is printed out to thekernel log in hex format as a…

Record: OESA-2025-2802
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVOESA-2025-28037.8

kernel security update

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix null-ptr-deref in block_touch_buffer tracepoint

Patch series "nilfs2: fix null-ptr-deref bugs on block tracepoints".

This series fixes null pointer dereference bugs that occur when using nilfs2 and two block-related tracepoints.

This patch (of 2):

It has been reported that when using "block:block_touch_buffer" tracepoint, touch_buffer() called from __nilfs_get_folio_block() causes a NULL pointer dereference, or a general protection fault when KASAN is enabled.

This happens because since the tracepoint was added in touch_buffer(), it references the dev_t member bh->b_bdev->bd_dev regardless of whether the buffer head has a pointer to a block_device structure. In the current implementation, the block_device structure is set after the function returns to the caller.

Here, touch_buffer() is used to mark the folio/page that owns the buffer head as accessed, but the common search helper for folio/page used by the caller function was optimized to mark the folio/page as accessed when it was reimplemented a long time ago, eliminating the need to call touch_buffer() here in the first place.

So this solves the issue by eliminating the touch_buffer() call itself.(CVE-2024-53131)

In the Linux kernel, the following vulnerability has been resolved:drm: adv7511: Fix use-after-free in adv7533_attach_dsi()The host_node pointer was assigned and freed in adv7533_parse_dt(), andlater, adv7533_attach_dsi() uses the same. Fix this use-after-free issueby dropping of_node_put() in adv7533_parse_dt() and calling of_node_put()in error path of probe() and also in the remove().(CVE-2024-57887)

In the Linux kernel, the following vulnerability has been resolved:ila: serialize calls to nf_register_net_hooks()syzbot found a race in ila_add_mapping() [1]commit 031ae72825ce ( ila: call nf_unregister_net_hooks() sooner )attempted to fix a similar issue.Looking at the syzbot repro, we have concurrent ILA_CMD_ADD commands.Add a mutex to make sure at most one thread is calling nf_register_net_hooks().[1] BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline] BUG: KASAN: slab-use-after-free in __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604Read of size 4 at addr ffff888028f40008 by task dhcpcd/5501CPU: 1 UID: 0 PID: 5501 Comm: dhcpcd Not tainted 6.13.0-rc4-syzkaller-00054-gd6ef8b40d075 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024Call Trace: <IRQ> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 rht_key_hashfn include/linux/rhashtable.h:159 [inline] __rhashtable_lookup.constprop.0+0x426/0x550 include/linux/rhashtable.h:604 rhashtable_lookup include/linux/rhashtable.h:646 [inline] rhashtable_lookup_fast include/linux/rhashtable.h:672 [inline] ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:127 [inline] ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline] ila_nf_input+0x1ee/0x620 net/ipv6/ila/ila_xlat.c:185 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook.constprop.0+0x42e/0x750 include/linux/netfilter.h:269 NF_HOOK include/linux/netfilter.h:312 [inline] ipv6_rcv+0xa4/0x680 net/ipv6/ip6_input.c:309 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6883 napi_poll net/core/dev.c:6952 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7074 handle_softirqs+0x213/0x8f0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] …

Record: OESA-2025-2803
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-11-CVE-2025-398107.8

CVE-2025-39810 in linux - Patched by Root

Root has patched CVE-2025-39810 in the linux package for Root:Debian:11. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-11-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-DEBIAN-12-CVE-2025-398107.8

CVE-2025-39810 in linux - Patched by Root

Root has patched CVE-2025-39810 in the linux package for Root:Debian:12. Multiple fixed versions available.

Record: ROOT-OS-DEBIAN-12-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVROOT-OS-UBUNTU-2204-CVE-2025-398107.8

CVE-2025-39810 in linux - Patched by Root

Root has patched CVE-2025-39810 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2204-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVROOT-OS-UBUNTU-2404-CVE-2025-398107.8

CVE-2025-39810 in linux - Patched by Root

Root has patched CVE-2025-39810 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

Record: ROOT-OS-UBUNTU-2404-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVUBUNTU-CVE-2025-398107.8

Record: UBUNTU-CVE-2025-39810
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-11

OSVAZL-67431No score

CVE-2025-39810 affecting package kernel 6.6.161.1-1

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: AZL-67431
Updated: 2026-11-05

OSVAZL-71206No score

CVE-2025-39810 affecting package kernel 5.15.200.1-1

In the Linux kernel, the following vulnerability has been resolved:

bnxt_en: Fix memory corruption when FW resources change during ifdown

bnxt_set_dflt_rings() assumes that it is always called before any TC has been created. So it doesn't take bp->num_tc into account and assumes that it is always 0 or 1.

Fix it by properly scaling the TX rings by bp->num_tc in the code paths mentioned above. Add 2 helper functions to determine bp->tx_nr_rings and bp->tx_nr_rings_per_tc.

Record: AZL-71206
Updated: 2026-11-02

OSVCLSA-2026-1771081379No score

kernel: Fix of 76 CVEs

HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once {CVE-2025-40318}
smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
drm/xe: Make dma-fences compliant with the safe access rules {CVE-2025-38703}
libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass {CVE-2025-38396}
anon_inode: explicitly block ->setattr()
anon_inode: use a proper mode internally
dynamic_dname(): drop unused dentry argument
anon_inode: raise SB_I_NODEV and SB_I_NOEXEC
Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118}
Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013}
drm/xe: Fix vm_bind_ioctl double free bug {CVE-2025-38731}
media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
HID: core: ensure __hid_request reserves the report ID as the first byte
wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
drm/i915: Protect access to driver and timeline name
sync_file: Protect access to driver and timeline name
dma-fence: Add safe access helpers and document the rules
VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() {CVE-2025-39806}
vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
i40e: remove read access to debugfs files {CVE-2025-39901}
wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346}
sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
software node: Correct a OOB check in software_node_get_reference_args() {CVE-2025-38342}
net: atm: add lec_mutex {CVE-2025-38323} -…

Record: CLSA-2026-1771081379
Updated: 2026-11-02

OSVCLSA-2026-1772815097No score

Fix of 104 CVEs

CVE-2025-38699
- scsi: bfa: Double-free fix {CVE-2025-38699}
CVE-2025-38697
- jfs: upper bound check of tree index in dbAllocAG {CVE-2025-38697}
CVE-2025-39823
- KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
CVE-2025-39689
- ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
CVE-2025-39749
- rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
CVE-2025-38728
- smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
CVE-2025-38676
- iommu/amd: Avoid stack buffer overflow from kernel cmdline {CVE-2025-38676}
CVE-2025-38574
- pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
CVE-2025-38572
- ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
CVE-2025-38685
- fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
CVE-2025-38563
- vm_ops: rename .split() callback to .may_split() {CVE-2025-38563}
- perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
CVE-2025-38702
- fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
CVE-2025-39911
- i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
CVE-2025-39971
- i40e: fix idx validation in config queues msg {CVE-2025-39971}
CVE-2025-40154
- ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
CVE-2025-39973
- i40e: increase max descriptors for XL710 {CVE-2025-39973}
- i40e: add validation for ring_len param {CVE-2025-39973}
CVE-2022-49026
- e100: Fix possible use after free in e100_xmit_prepare {CVE-2022-49026}
CVE-2025-38724
- nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
CVE-2025-39853
- i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
CVE-2025-39860
- Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
CVE-2025-39891
- wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
CVE-2025-38530
- comedi: pcl812: Fix bit shift out of bounds {CVE-2025-38530}
CVE-2025-38529
- comedi: aio_iiro_16: Fix bit shift out of bounds {CVE-2025-38529}
CVE-2025-38497
- usb: gadget: configfs: Fix OOB read on empty string write {CVE-2025-38497}
CVE-2025-38483
- comedi: das16m1: Fix bit shift out of bounds {CVE-2025-38483}
CVE-2025-38482
- comedi: das6402: Fix bit shift out of bounds {CVE-2025-38482}
CVE-2025-39702
- ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
CVE-2025-39730
- NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
CVE-2025-39841
- scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
CVE-2025-39817
- efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
CVE-2025-38494
- HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38494}
- HID: core: ensure __hid_request reserves the report ID as the first byte {CVE-2025-38494}
- HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
CVE-2025-39757
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
CVE-2025-38527
- smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
CVE-2023-52854
- padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
CVE-2024-35867
- smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
CVE-2024-50061
- i3c: master: cdns: Fix use after free vulnerability in cdns_i3c_master Driver Due to Race Condition {CVE-2024-50061}
CVE-2025-39965 -…

Record: CLSA-2026-1772815097
Updated: 2026-11-02

OSVCLSA-2026-1786761805No score

kernel: Fix of 46 CVEs

wifi: ath11k: update channel list in reg notifier instead reg worker {CVE-2025-23133}
wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint {CVE-2025-23133}
KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957}
KVM: x86: forcibly leave nested mode on vCPU reset {CVE-2022-3344}
RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133}
crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231}
tls: handle data disappearing from under the TLS ULP {CVE-2025-38616}
Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140}
Bluetooth: L2CAP: complete CVE-2026-23395 hardening (chan_lock + ident clear + memset ordering)
wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
net: add exit_batch_rtnl() method
rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
virt/coco/sev-guest: Double-buffer messages {CVE-2023-53769}
ASoC: SOF: avoid a NULL dereference with unsupported widgets {CVE-2023-54233}
bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232}
sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371}
net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670}
intel_th: fix device leak on output open() {CVE-2026-23091}
batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642}
i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627}
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498}
mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434}
x86/efi: defer freeing of boot services memory {CVE-2026-23352}
KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112}
usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108}
KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104}
drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083}
amba: bus: fix refcount leak {CVE-2023-54230}
exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree {CVE-2023-54194}
octeontx2-af: Add validation for lmac type {CVE-2023-54129}
rcu: dump vmalloc memory info safely {CVE-2023-54113}
wifi: rtw88: use work to update rate to avoid RCU warning {CVE-2023-54071}
bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps {CVE-2023-54033}
ASoC: soc-compress: Reposition and add pcm_mutex {CVE-2023-53866}
netlink: do not hard code device address lenth in fdb dumps {CVE-2023-53863}
md/raid5-cache: fix a deadlock in r5l_exit_log() {CVE-2023-53848}
tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak {CVE-2022-50824}
net: stmmac: fix possible memory leak in stmmac_dvr_probe() {CVE-2022-50663}
bpf: Fix reference state management for synchronous callbacks {CVE-2022-50650}
blk-mq: fix tags leak when shrink nr_hw_queues {CVE-2023-54227}
usbnet: Run unregister_netdev() before unbind() again {CVE-2022-49501}
scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
Bluetooth: L2CAP: Fix responding with wrong PDU type
netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}

Record: CLSA-2026-1786761805
Updated: 2026-11-02

OSVCLSA-2026-1789141176No score

kernel: Fix of 131 CVEs

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
net_sched: red: fix a race in __red_change() {CVE-2025-38108}
iio: event: Fix event FIFO reset race {CVE-2026-64496}
netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} -…

Record: CLSA-2026-1789141176
Updated: 2026-11-02

OSVCLSA-2026-1791852988No score

kernel: Fix of 107 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
sctp: validate embedded address parameter length {CVE-2026-74287}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
enic: fix tx_hang_reset use-after-free on device removal {CVE-2026-74725}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
xfs: bounds-check buffer log item's dirty bitmap {CVE-2026-80536}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
smb: client: reject overlapping data areas in SMB2 responses {CVE-2026-64257}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
crypto: qat - fix VF2PF work teardown race in adf_disable_sriov() {CVE-2026-64438}
crypto: qat - protect interrupt mask CSRs with a spinlock {CVE-2026-64438}
crypto: qat - remove intermediate tasklet for vf2pf {CVE-2026-64438}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
crypto: algif_aead - fix uninitialized ctx->init {CVE-2025-39964}
sctp: fix race between sctp_wait_for_connect and peeloff {CVE-2026-63971}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after…

Record: CLSA-2026-1791852988
Updated: 2026-11-02

OSVCLSA-2026-1791858083No score

kernel: Fix of 94 CVEs

netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
IB/isert: reject PDUs declaring more data than was received {CVE-2026-90414}
RDMA/mlx5: Fix integer overflow of user QP buffer size {CVE-2026-90435}
IB/isert: reject login PDUs declaring more data than was received {CVE-2026-90413}
xfrm: ah6: validate routing header segments_left {CVE-2026-80844}
drm/amd/display: set new_stream to NULL after release {CVE-2026-68236}
RDMA/srpt: Fix srpt_alloc_rw_ctxs() unwind counters {CVE-2026-100075}
nvmet-rdma: handle inline data with a nonzero offset {CVE-2026-72129}
netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() {CVE-2026-97417}
smb: client: restrict implied bcc[0] exemption to responses without data area {CVE-2026-64448}
usb: free iso schedules on failed submit {CVE-2026-64348}
USB: iowarrior: fix use-after-free on disconnect race {CVE-2026-64341}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
crypto: qat - protect service table iterations with service_lock {CVE-2026-64305}
crypto: qat - validate RSA CRT component lengths {CVE-2026-64304}
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes {CVE-2026-64422}
udf: validate VAT header length against the VAT inode size {CVE-2026-64323}
crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
net: tun: bound receive headroom {CVE-2026-81000}
bridge: stp: Fix a potential use-after-free when deleting a bridge {CVE-2026-72389}
scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer {CVE-2026-74556}
rhashtable: clear stale iter->p on table restart {CVE-2026-64563}
mpls: reload header after pskb_may_pull() {CVE-2026-89555}
vhost: reset the vring metadata cache on vring reconfiguration {CVE-2026-74580}
net/sched: cls_route: fix fastmap use-after-free on filter {CVE-2026-74583}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
Bluetooth: RFCOMM: Fix session UAF in set_termios {CVE-2026-68188}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
libceph: refresh auth->authorizer_buf{,_len} after authorizer update {CVE-2026-68156}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet…

Record: CLSA-2026-1791858083
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20081-1No score