A use-after-free vulnerability exists in the Linux kernel's NFC LLCP implementation due to missing return statements after LLCP_CLOSED state checks. This causes double release of socket resources leading to reference count underflow and potential memory corruption.
CVE-2026-31627 is a high-severity vulnerability in the Linux kernel's i2c s3c24xx driver. It involves improper validation of the size byte in SMBUS messages, which should be checked to ensure it falls within the valid range before use. This flaw could lead to critical impacts on confidentiality, integrity, and availability if exploited. The issue has been resolved by adding size verification similar to a previous fix in the i2c tegra driver.
CVE-2026-31626 is a vulnerability in the Linux kernel's rtl8723bs driver where an 8-byte variable le_tmp64 was not fully initialized before use in the rtw_BIP_verify() function. This could lead to unpredictable behavior due to use of uninitialized data. The issue was fixed by initializing le_tmp64 to zero at the start of the function.
A vulnerability in the Linux kernel's USB CDC Phonet driver allows a malicious USB device to overflow the skb_shared_info->frags[] array by sending an unbounded sequence of full-page bulk transfers. This issue has been fixed by dropping the skb and incrementing the length error when the frag limit is reached, preventing the overflow.
CVE-2026-31622 is a high-severity vulnerability in the Linux kernel's NFC digital subsystem. It involves a missing bounds check on the NFC-A cascade depth in the SDD response handler, allowing a malicious NFC peer device to write beyond allocated memory by manipulating cascade rounds. This flaw arises because the driver does not enforce the ISO 14443-3 limit of three cascade levels, risking heap overflow. The vulnerability has been resolved by adding checks to reject responses that would exceed buffer limits.
A flaw in the Linux kernel bnge driver error handling causes a NULL pointer dereference when auxiliary_device_add() fails. The error path calls auxiliary_device_uninit() but does not return immediately, leading to a use-after-free condition and a NULL pointer dereference during cleanup.
A divide-by-zero vulnerability in the Linux kernel's fbdev tdfxfb driver related to the FBIOPUT_VSCREENINFO ioctl has been resolved. The flaw could cause a crash when the driver uses the pixclock value directly in division operations. This issue is similar to a previously fixed divide-by-zero error in another fbdev driver component.
CVE-2026-31617 is an integer underflow vulnerability in the Linux kernel's USB Network Control Model (NCM) gadget driver. It occurs because the block_len value from the host-supplied NTB header lacks a proper lower bound check, allowing underflow in index calculations. This flaw enables a malicious USB host to manipulate internal pointers, causing adjacent kernel memory to be copied into network buffers, potentially leading to information disclosure. The issue has been fixed by validating minimum block_len values to prevent underflow conditions.
A vulnerability in the Linux kernel's USB gadget Phonet function allows a malicious USB host to overflow the skb_shared_info->frags[] array by sending a continuous sequence of full-page OUT transfers. This overflow occurs because the function pn_rx_complete() does not reset the skb buffer when the host sends exactly PAGE_SIZE bytes, causing fragments to accumulate beyond the maximum allowed. The issue is addressed by dropping the skb and accounting a length error when the fragment limit is reached.
A vulnerability in the Linux kernel's renesas_usb3 gadget driver involves lack of validation of the endpoint index in standard USB request handlers. Specifically, the GET_STATUS and SET/CLEAR_FEATURE handlers use the endpoint number from the host-supplied wIndex without verifying it against the actual number of endpoints the device supports. This could lead to invalid pointer dereferences. The issue has been fixed by adding validation to ensure the endpoint index is within the valid range before use.
CVE-2026-31612 is a high-severity vulnerability in the Linux kernel's ksmbd component. It involves improper validation of the EaNameLength field in the smb2_get_ea() function, which can lead to uninitialized heap data being leaked to a client. The flaw arises because the length value is used directly in a strncmp() call without verifying that it matches the actual size of the input buffer. This vulnerability has been resolved by adding proper size checks to prevent misuse of the length as a trusted buffer size.
CVE-2026-31611 is a high-severity vulnerability in the Linux kernel's ksmbd component. It involves improper handling of Security Identifier (SID) sub-authorities in the parse_dacl() function. Specifically, the code reads a third sub-authority from a SID without verifying that it exists, potentially causing out-of-bounds memory reads. This can lead to incorrect POSIX file mode settings derived from unintended memory, which may impact system integrity and availability. The issue is fixed by ensuring that the SID has at least three sub-authorities before accessing the third one.
A memory leak vulnerability in the Linux kernel's ksmbd component occurs when SPNEGO token decoding fails after allocating a mechToken. The allocated memory is not freed due to a conditional check that skips cleanup, allowing untrusted clients to cause slow memory leaks pre-authentication.
A critical double-free vulnerability (CVE-2026-31608) in the Linux kernel's SMB server component was resolved. The issue involved improper handling of smb_direct_free_sendmsg calls after smb_direct_flush_send_list(), which could lead to memory corruption. This flaw has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
A divide-by-zero vulnerability was identified and resolved in the udlfb driver of the Linux kernel's framebuffer device (fbdev) subsystem. The flaw occurs during the FBIOPUT_VSCREENINFO ioctl operation when the driver uses the pixclock value directly in a division, which can cause a crash. This issue is similar to a previously fixed divide-by-zero error in another fbdev driver (fb_pm2fb).
A division by zero vulnerability was identified and fixed in the Linux kernel's sm750fb framebuffer driver. The function ps_to_hz() could be called with a zero pixclock value, leading to a division by zero error. The fix involves rejecting zero pixclock values in the lynxfb_ops_check_var() function, aligning with other framebuffer drivers.
CVE-2026-31602 is a vulnerability in the Linux kernel ALSA ctxfi driver where the number of page table pages (PTP) was incorrectly increased from 1 to 4, causing out-of-bounds memory access and page faults. This occurs because the driver always uses PTEs from a single PTP page, but the code attempts to access beyond the allocated space when multiple pages are assumed. The issue was fixed by reverting the PTP count back to 1, preventing invalid memory access.
A vulnerability in the Linux kernel's vfio/xe driver caused a kernel crash (Oops) when attempting to reset virtual function (VF) devices that do not support migration. This occurred because certain members required for reset handling were only initialized during migration initialization, leading to a page fault. The issue was fixed by reorganizing the initialization code to separate VF initialization from migration initialization.
A NULL pointer dereference vulnerability was identified and fixed in the Linux kernel's vidtv media driver. The issue occurs when vidtv_psi_pmt_stream_init() returns NULL due to memory allocation failure, but the subsequent function vidtv_channel_pmt_match_sections() does not check for this NULL value before dereferencing it. This leads to a general protection fault (kernel crash). The fix adds a NULL check to prevent dereferencing a NULL pointer and cleans up allocated resources on failure.
A use-after-free vulnerability in the Linux kernel's ocfs2 filesystem was fixed. The flaw occurs in the ocfs2_fault() function when filemap_fault() returns VM_FAULT_RETRY, potentially causing a concurrent munmap() to free a vm_area_struct that ocfs2_fault() still references. This leads to a dangling pointer dereference. The fix involves avoiding use of the freed pointer by saving necessary data before the lock is dropped.