CVE-2026-31587 is a use-after-free vulnerability in the Linux kernel's ASoC qcom q6apm component. The issue arises because the component and its dynamic DAIs (Digital Audio Interfaces) are allocated using device-managed APIs, leading to incorrect free ordering. This can cause the DAIs to be freed while the component still holds references to them, resulting in a kernel memory corruption. The vulnerability has a high severity score of 7.8 and affects the Linux kernel's sound subsystem.
A vulnerability in the Linux kernel's vidtv driver causes state corruption and memory leaks when the start_streaming function fails. The nfeeds counter is incorrectly incremented without being decremented on failure, leading to inconsistent driver state and resource leaks.
CVE-2026-31584 is a use-after-free vulnerability in the MediaTek video codec encoder release path in the Linux kernel. The issue arises because the encoder release function frees the context structure without properly cancelling or synchronizing pending workqueue tasks, leading to potential access of freed memory. This race condition can cause high impact including confidentiality, integrity, and availability loss. The vulnerability has been confirmed with Kernel Address Sanitizer (KASAN).
A use-after-free vulnerability in the Linux kernel's hwmon powerz driver was fixed. The flaw occurs when a USB disconnect frees a URB pointer, but subsequent read operations may still dereference this freed pointer, leading to potential instability or crashes. The fix involves nullifying the URB pointer on disconnect and adding checks to prevent access to freed memory.
A use-after-free vulnerability was identified and fixed in the Linux kernel's ALSA 6fire driver. The issue occurs during device disconnect when the chip structure is accessed after it has been freed, leading to potential memory corruption. The fix involves reordering the teardown sequence to ensure the chip is not accessed after the card is freed.
CVE-2026-31578 is a use-after-free and double-free vulnerability in the Linux kernel's as102_usb driver. The flaw arises from a race condition where memory is freed prematurely after the device is registered, but before all open file descriptors are closed. This can lead to kernel memory corruption when the driver's release function accesses already freed memory.
A NULL pointer dereference vulnerability exists in the Linux kernel's nilfs2 filesystem code. The issue occurs because the DAT inode's btree node cache (i_assoc_inode) is lazily initialized but assumed to be initialized during garbage collection operations. If the NILFS_IOCTL_CLEAN_SEGMENTS ioctl is called immediately after mounting before any btree operation, a NULL dereference leads to a general protection fault. The flaw is fixed by initializing the btree node cache at mount time.
A use-after-free and double-free vulnerability was fixed in the Linux kernel's hackrf driver. The issue arises from a race condition where memory is freed after the device is registered in hackrf_probe(), but before all open file descriptors are released. This can lead to unsafe memory access and potential kernel instability or crashes.
A vulnerability in the Linux kernel's KVM implementation for LoongArch architecture was fixed by properly handling cases where EIOINTC's coremap is empty. The flaw caused an out-of-bounds access in the physical CPU ID mapping array, potentially leading to a denial of service due to kernel crash. The issue is addressed by correcting the CPU ID assignment logic in the affected function.
A Linux kernel issue involving the pm_restore_gfp_mask() function caused spurious WARN_ON() warnings due to a refcount-based GFP mask management change. This was fixed by removing the WARN_ON() wrapper to prevent false warnings during certain hibernation paths without affecting functionality.
A vulnerability in the Linux kernel's KVM implementation for LoongArch architecture was fixed by correcting the base address calculation in the function kvm_eiointc_regs_access(). The issue involved improper calculation of the register base address due to incorrect type conversion of the array base address before adding an offset.
A vulnerability in the Linux kernel related to the handling of the X86_CR4_FRED bit in the CR4 pinned bits mask has been resolved. The issue involved a timing window during system boot where exceptions could not be handled properly, especially affecting SEV-ES, SEV-SNP, and TDX guests, potentially causing triple faults. The fix removes the FRED bit from the CR4 pinning mask to prevent disabling CR4 pinning temporarily, which could be exploited by attackers to disable security features and compromise the system.
A vulnerability in the Linux kernel related to the LoongArch architecture has been fixed. The issue involved missing NULL checks for the kstrdup() function, which could lead to a kernel oops during early boot if memory allocation failed while parsing the CPU model from the device tree. Additionally, a code change replaced multiple calls to of_node_put() by using of_root instead of of_find_node_by_path("/").
A vulnerability in the Linux kernel's KVM implementation for LoongArch architecture was fixed by making the function kvm_get_vcpu_by_cpuid() more robust. The function previously did not handle negative cpuid values properly, leading to an out-of-bounds access in the physical CPU ID mapping array. This flaw has been addressed by returning NULL when a negative cpuid is passed, preventing invalid memory access.
CVE-2026-31553 is a high-severity vulnerability in the Linux kernel's KVM module for arm64 architecture. The flaw involves incorrect calculation of descriptor addresses in the __kvm_at_swap_desc() function, where an offset is improperly scaled, leading to erroneous virtual address computation. This issue has been fixed by correcting the address calculation logic.
CVE-2026-31552 is a vulnerability in the Linux kernel's wlcore WiFi driver where an incorrect error code causes an infinite loop and CPU soft lockup. The issue arises when there is insufficient headroom in packet buffers, leading to a retry loop that never terminates. This flaw has been fixed by changing the error return from -EAGAIN to -ENOMEM, causing the packet to be dropped and preventing the infinite loop.
A vulnerability in the Linux kernel's bcm2835-power driver causes a timeout issue during power management suspend operations on BCM2711 hardware. The tight polling loop waiting for the ASB bridge acknowledgment is sometimes too short, causing failures that leave the V3D power domain in a broken state. This can lead to bus faults or system hangs on subsequent accesses.
A vulnerability in the Linux kernel cp2615 driver could cause a NULL-pointer dereference during device probe if the USB device serial string is missing. This occurs because the driver uses the serial string as the i2c adapter name without verifying its existence. The issue has been fixed by adding a check to ensure the serial number exists before accessing it.
A vulnerability in the Linux kernel's drm/xe component was fixed to address a missing runtime power management (PM) reference in the ccs_mode_store function. The flaw involved calling xe_gt_reset(), which internally calls xe_pm_runtime_get_noresume() without holding the required outer runtime PM reference, causing warnings and potential improper power management behavior. The fix adds a scope-based guard to ensure the runtime PM reference is held properly during the call.
A vulnerability in the Linux kernel NFC driver (nxp-nci) was resolved by allowing GPIOs to enter sleep mode. This fix addresses a kernel warning (WARN_ON) related to GPIO operations, enabling the driver to properly handle GPIOs connected via I2C GPIO expanders.