CVE-2026-43039 is a critical vulnerability in the Linux kernel's ti icssg-prueth network driver. It involves a missing data copy in the zero-copy (ZC) RX dispatch path, causing uninitialized kernel heap memory to be leaked to userspace. Additionally, an incorrect recycle operation corrupts page pool state. The flaw has been fixed by copying packet data properly and removing the erroneous recycle call.
A vulnerability in the Linux kernel NFC driver for the pn533 device allowed the UART receive buffer to grow without bounds when receiving malformed UART traffic. This was due to the driver appending every incoming byte to the receive buffer until a complete frame was recognized, potentially exhausting buffer limits. The issue has been resolved by bounding the receive buffer and dropping partial frames once the buffer is full.
CVE-2026-43031 is a vulnerability in the Linux kernel's Xilinx axienet network driver related to Byte Queue Limits (BQL) accounting for transmit (TX) packets that span multiple buffer descriptors (scatter-gather). The flaw causes BQL to incorrectly track bytes in-flight when packet buffer descriptors complete across different NAPI polls, leading to a stall in the TX queue. The issue is fixed by changing the accounting to use the total packet length from the socket buffer rather than summing per-descriptor lengths.
A high-severity vulnerability in the Linux kernel's Multipath TCP (mptcp) implementation causes a soft lockup in the mptcp_recvmsg() function when receiving data with MSG_PEEK and MSG_WAITALL flags. This occurs because the socket buffer (skb) is not removed from the receive queue, causing the kernel to enter an infinite loop waiting for data. The issue has been fixed by modifying the code to track the last peeked skb, enabling proper waiting behavior and preventing the lockup.
CVE-2026-43015 is a use-after-free vulnerability in the Linux kernel's macb network driver related to clock (clk) handling during PCI glue driver removal. The issue occurs because platform_device_unregister() may still attempt to use registered clocks during runtime resume callbacks, leading to a use-after-free condition. The vulnerability has been addressed by saving pointers to clocks into local variables before the platform device is unregistered to prevent invalid memory access.
A resource management vulnerability in the Linux kernel's macb network driver was fixed by ensuring that fixed rate clocks registered with clk_register_fixed_rate() are properly unregistered with clk_unregister_fixed_rate(). Failure to unregister these clocks could lead to resource leaks.
A vulnerability in the Linux kernel's gpio qixis-fpga driver was fixed by correcting error handling for the devm_regmap_init_mmio() function. The function returns an ERR_PTR() on failure, but the original code incorrectly checked for NULL, which never occurs on error. This could lead to an invalid pointer dereference.
A vulnerability in the Linux kernel's accel/qaic component involves improper handling of DBC deactivation when the owning user process terminates prematurely. This can cause the host to become out-of-sync with available DBCs, leading to resource leaks and indefinite hangs when a new user tries to activate a network using the same DBC.
CVE-2026-43006 is a high-severity vulnerability in the Linux kernel's io_uring subsystem. It involves improper handling of zero-length fixed buffer imports, which leads to out-of-bounds memory reads. This flaw was caused by a boundary check that incorrectly allowed a buffer address at the exact end of a registered region when the length was zero. The issue can cause a kernel slab-out-of-bounds read, potentially leading to system instability or denial of service.
A vulnerability in the Linux kernel's hwmon subsystem (tps53679 driver) allows out-of-bounds stack read due to improper handling of zero-length block reads from i2c_smbus_read_block_data(). The issue is fixed by treating zero-length reads as errors, preventing access to memory before the buffer.
A resource leak vulnerability in the Linux kernel's spi: stm32-ospi driver was fixed by correcting the remove() callback. The callback previously returned early if pm_runtime_resume_and_get() failed, which caused cleanup of the SPI controller and other resources to be skipped. The fix removes this early return to ensure proper cleanup regardless of the PM resume result.
A vulnerability in the Linux kernel's drm/xe component allowed writes to read-only virtual memory areas (VMAs) due to insufficient checks in the page fault handler. This flaw has been resolved by adding code to reject write or atomic access to read-only VMAs in the xe_pagefault_service after VMA lookup.
A vulnerability in the Linux kernel's amlogic spifc-a4 SPI driver was fixed by ensuring proper cleanup of the NAND ECC engine on probe failure and device removal. The issue was that the ECC engine was registered during probe but not unregistered on failure or removal, potentially causing resource leaks or instability.
CVE-2026-41374 is a vulnerability in OpenClaw versions before 2026.3.31 where the software performs Discord audio preflight transcription before validating member authorization. This allows unauthenticated attackers to trigger audio preflight processing without membership allowlist validation, potentially leading to resource exhaustion.
OpenClaw versions before 2026.3.31 have a vulnerability due to an incomplete host environment security policy. This flaw allows untrusted models with approved host execution requests to override compiler-related environment variables, potentially executing arbitrary code during build processes.
CVE-2026-5362 is a cross-site scripting (XSS) vulnerability in pimcore version 12.3.3. An authenticated user with permission to edit document content can inject crafted HTML or JavaScript into a Document embed editable field. This malicious script executes when the published page is viewed, potentially leading to client-side code execution. The vulnerability has a medium severity rating with a CVSS score of 4.8.
A buffer overflow vulnerability in the Linux kernel's TH1520 AON firmware protocol driver has been fixed. The issue involved unsafe pointer arithmetic accessing the 'mode' field, leading to a potential buffer overflow. Additionally, custom endian macros were replaced with standard kernel macros for improved portability. The fix has been tested and confirmed to not affect GPU power-up or driver probing.
A flaw in the Linux kernel's EDAC/mc subsystem caused improper initialization ordering in the edac_mc_alloc() function. When allocation of mci->pvt_info fails, the error path calls put_device() before the device is initialized, leading to a call to an uninitialized release function pointer. This results in kernel warnings and potential instability during device error handling.
CVE-2026-31687 addresses a Linux kernel vulnerability in the OMAP GPIO driver where the omap_mpuio_driver was improperly registered within the probe() callback. This practice can cause a deadlock due to device locking rules in the driver core and the driver was never unregistered upon module unload. The fix involves registering the driver during module initialization and unregistering it on module exit.
CVE-2026-42371 is a numeric truncation error vulnerability in uriparser versions before 1.0.1. It occurs during text range comparison when an application processes URIs with lengths in the gigabyte range. This flaw can cause a denial of service due to application crashes or instability.