A memory leak vulnerability was fixed in the Linux kernel's media subsystem, specifically in the radio-keene driver. The issue occurred in the usb_keene_probe() function where the v4l2 control handler was initialized but not freed if certain registration functions failed, causing memory to leak. The fix adds a call to v4l2_ctrl_handler_free() in the error path to properly release allocated resources.
A reference leak vulnerability was identified and fixed in the Linux kernel's media subsystem, specifically in the mtk-mdp driver. The issue involved the mtk_mdp_remove() function failing to release a platform device reference acquired during mtk_mdp_probe(), potentially leading to resource leakage. The fix adds a call to platform_device_put() to properly decrement the reference count.
A vulnerability in the Linux kernel's Ceph filesystem implementation was fixed by supplying the correct snapshot context in the ceph_zero_partial_object() function. The flaw caused data inconsistencies in snapshots due to missing snapshot context during OSD write operations. This could lead to corrupted or inconsistent snapshot data when using Ceph snapshots.
CVE-2026-43275 is a medium severity vulnerability in the Linux kernel's UFS core driver related to runtime power management (RPM). The flaw involves a race condition during system suspend when the RPM level is zero, where exception event handling work was not properly flushed. This could lead to the driver accessing hardware after the system entered deep power-down, causing a system crash. The issue is resolved by explicitly flushing the exception handling work and disabling auto background operations before suspend proceeds.
CVE-2026-43268 is a vulnerability in the Linux kernel's hfsplus filesystem driver where special inodes are incorrectly treated as regular files. This issue was addressed by ensuring that special inodes are represented with the S_IFREG type to comply with inode type requirements in the kernel.
CVE-2026-43269 is a medium severity vulnerability in the Linux kernel's drm/atmel-hlcdc driver involving a memory leak caused by improper cleanup in the atomic_destroy_state callback. The issue results in some drm_crtc_commit objects not being freed, leading to increased slab memory usage over time during graphics application usage. The fix involves using the __drm_atomic_helper_plane_destroy_state() function to properly release all no longer needed objects.
CVE-2026-43229 is a medium severity vulnerability in the Linux kernel's chips-media wave5 driver. It involves an improper device cleanup order that can cause kernel panic due to hardware register access after the device has been powered down. This occurs because video device unregistration was done too late, allowing a worker thread to access powered-off hardware registers, triggering a synchronous external abort and kernel panic during encoding operations.
CVE-2026-43264 is a medium severity vulnerability in the Linux kernel's framebuffer device (fbdev) subsystem related to device tree display timing parsing. A reference count leak occurs in the of_get_display_timings() function due to improper cleanup on error paths, which can lead to resource exhaustion. The issue is fixed by correcting the error handling to properly decrement the reference count before cleanup.
CVE-2026-43271 is a medium-severity vulnerability in the Linux kernel's md-cluster component. It involves a NULL pointer dereference in the process_metadata_update() function due to a race condition during the MD array startup sequence. If a METADATA_UPDATED message is received before the main MD thread is initialized, the kernel may panic. The issue is fixed by validating the thread pointer and safely ignoring update requests when the array is not ready.
A memory leak vulnerability was fixed in the Linux kernel's io_uring subsystem related to sgtable not being freed on mapping failures. This occurs in a rare scenario on PAGE_POOL_32BIT_ARCH_WITH_64BIT_DMA machines when io_populate_area_dma() fails, causing an initialized sgtable to remain allocated. The issue was due to an error path that did not properly clean up the allocated table.
CVE-2026-43041 addresses a memory leak vulnerability in the Linux kernel's qrtr subsystem. The issue arises from the use of the deprecated radix_tree API for managing qrtr_tx_flow, where intermediate nodes may remain orphaned and unreclaimed if memory allocation fails during tree construction. The vulnerability is fixed by migrating from radix_tree to the xarray API, which properly cleans up internal nodes, preventing memory leaks.
A memory leak vulnerability was identified and fixed in the Linux kernel's rtl8723bs staging driver. The issue occurred because the function cfg80211_inform_bss_frame() could return NULL on failure, causing an allocated buffer to not be freed properly. This could lead to resource exhaustion over time. The fix ensures that the allocated buffer is freed on both success and failure paths.
CVE-2026-43227 is a medium-severity vulnerability in the Linux kernel's sh_tmu clocksource/clockevent driver. The issue arises because the driver attempts to manage power and clock states while holding raw spinlocks, which conflicts with runtime power management calls that use regular spinlocks. This leads to lockdep warnings and invalid wait context bugs, particularly in PREEMPT_RT builds where normal spinlocks can sleep. The vulnerability does not affect non-PREEMPT_RT builds significantly. The fix involves always leaving the device powered and clocked on after probe to avoid these locking conflicts.
CVE-2026-43043 is a medium severity vulnerability in the Linux kernel's AF_ALG crypto interface. It involves a NULL pointer dereference caused by improper handling of the end marker in a scatter/gather list (SGL) when chaining new af_alg_tsgl structures. This flaw can lead to a kernel panic during the crypto scatterwalk operation.
A vulnerability in the Linux kernel's pvrusb2 driver caused a URB (USB Request Block) leak when a write URB was submitted successfully but the subsequent read URB submission failed. This led to attempts to resubmit an active URB, triggering warnings and potentially causing resource leaks. The issue has been fixed by ensuring the write URB is properly unlinked and waited upon if the read URB submission fails.
CVE-2026-31754 is a medium severity vulnerability in the Linux kernel's cdns3 USB gadget driver. The issue arises when the gadget initialization fails, leaving the hardware in gadget mode while the software state remains inactive, causing a state inconsistency. This inconsistency violates the DRD controller design specification and can lead to a synchronous external abort crash in the xHCI host controller during role switching.
A vulnerability in the Linux kernel NFC driver for the pn533 device allowed the UART receive buffer to grow indefinitely when receiving malformed UART traffic without valid PN532 frame headers. This could lead to a denial of service by exhausting kernel memory. The issue was fixed by bounding the receive buffer and dropping accumulated partial frames once the buffer is full.
CVE-2026-31753 is a medium severity vulnerability in the Linux kernel's auxdisplay line-display subsystem. It involves a NULL pointer dereference in the linedisp_release() function caused by improper retrieval of the enclosing linedisp structure when the attachment list is empty or removed. This can lead to a kernel crash (denial of service).
A command injection vulnerability exists in In Progress® Telerik® UI for WinUI versions prior to 2025 Q1 (3.0.0) due to improper neutralization of hyperlink elements. This flaw allows an attacker with local access and user interaction to execute arbitrary commands, potentially leading to full system compromise. The vulnerability has a high severity score of 7.8 CVSS v3.1. No specific affected versions or patch information is provided in the data.
Electerm versions 3.8.15 and earlier contain a critical vulnerability where the terminal hyperlink handler passes clicked URLs directly to shell.openExternal without validating the protocol. This allows an attacker who controls terminal output to execute arbitrary code or access local files if the victim clicks a malicious link. No patches are publicly available at the time of disclosure.