linux kernel

In the Linux kernel, CVE-2026-31525 has exposed a subtle but serious correctness flaw in the BPF interpreter’s signed 32-bit division and modulo paths. The issue is not a classic memory corruption bug; it is a math bug with security consequences, triggered when the interpreter handles S32_MIN...

Linux administrators are waking up to a new XFS kernel flaw that looks deceptively small in code but serious in consequence. CVE-2026-31453 affects the Linux kernel’s XFS journaling path, where tracepoint code can dereference a log item after a push callback has already made it eligible for...

In the Linux kernel’s Bluetooth stack, CVE-2026-31498 is the kind of bug that looks routine at first glance and then turns out to be two problems in one: a resource leak in L2CAP ERTM reconfiguration and a potential infinite loop triggered by a zero packet size. The published fix targets the...

CVE-2026-31503 is a small-looking Linux kernel networking fix with outsized operational significance: UDP’s port-bind conflict detection could miss a collision when the code switched to the newer hash2 lookup path, allowing a wildcard bind such as [::]:8888 or 0.0.0.0:8888 to succeed even though...

Overview CVE-2026-31509 is a Linux kernel vulnerability in the NFC NCI path that was published on April 22, 2026, and quickly drew attention because the bug is not a flashy memory corruption issue but a locking-order failure with real stability implications. The upstream fix is narrowly scoped...

The Linux kernel has published CVE-2026-31447 for an ext4 mount-time validation flaw, and the fix is narrow but important: reject filesystems that combine bigalloc with a nonzero s_first_data_block. In plain terms, ext4 already does not support that geometry, so the kernel now refuses to mount...

The Linux kernel’s ext4 filesystem is now facing a newly published CVE that closes off an unsupported mount configuration before it can do damage. CVE-2026-31447 addresses a specific mismatch between bigalloc and a nonzero s_first_data_block, and the fix is simple in spirit: refuse to mount a...

CVE-2026-31500 is a classic example of how a small synchronization mistake in a mature kernel driver can turn into a serious memory-safety bug. The flaw sits in the Linux Bluetooth Intel path, where btintel_hw_error() can race with device shutdown logic and end up touching a response buffer...

The latest Linux Bluetooth security issue to hit public tracking is CVE-2026-31500, a kernel bug in the Intel Bluetooth driver path that can race during hardware-error recovery and device shutdown. According to the published record, the problem is that btintel_hw_error issues synchronous HCI...

The Linux kernel’s SMC networking stack is back in the security spotlight with CVE-2026-31507, a flaw that can turn a seemingly ordinary tee operation into a double-free and, in practice, a kernel crash. The bug sits in the splice-based receive path, where SMC’s smc_rx_splice attaches private...

A newly published Linux kernel CVE is drawing attention for a reason that should concern anyone running embedded or appliance-class Linux systems: CVE-2026-31485 is a use-after-free-style teardown race in the spi-fsl-lpspi driver, and the upstream fix changes controller registration and removal...

Linux administrators received a fresh reminder this week that ext4’s maturity does not make it immune to memory-safety bugs. CVE-2026-31449 is a slab-out-of-bounds read in the Linux kernel’s ext4 extent-tree logic, and it appears in a code path that corrects index entries after leaf extents are...

Linux has published another Bluetooth kernel fix that looks small on the surface but matters for anyone tracking availability and stability risks in the network stack. CVE-2026-31510 covers a null-pointer dereference in l2cap_sock_ready_cb, where the kernel now checks whether the sk pointer is...

Linux has published CVE-2026-31510 for a Bluetooth L2CAP bug that can crash the kernel when l2cap_sock_ready_cb touches a sk pointer without first checking whether it is NULL. The published record includes a KASAN-backed null-pointer dereference trace and ties the issue to an l2cap_info_timeout...

CVE-2026-31489 is a classic Linux kernel lifetime bug with outsized operational meaning: a seemingly small double-put in the Meson SPI controller driver can still turn into a crash, a teardown failure, or a hard-to-debug stability problem when a system removes the device. The issue is simple on...

In the Linux kernel, CVE-2026-31431 marks a small but telling correction in the algif_aead crypto interface: the code is being pushed back toward out-of-place operation after a prior attempt to optimize for in-place handling proved unnecessary. The published description says the fix mostly...

CVE-2026-31497 is another reminder that the most interesting Linux kernel bugs are often the quiet ones. In this case, the flaw sits in the Bluetooth USB driver’s handling of SCO alternate settings, where a small lookup table was being indexed with an unbounded value derived from the number of...

In the Linux graphics stack, CVE-2026-31462 is a reminder that even a small ordering bug in an advanced driver can ripple into visible instability, especially when the GPU is juggling multiple compute contexts in rapid succession. The flaw in drm/amdgpu centers on PASID reuse, where a newly...

CVE-2026-31462 is a small-looking Linux kernel flaw with a very specific failure mode, but it sits in exactly the kind of plumbing that can cause outsized disruption when it misbehaves. The vulnerability in drm/amdgpu is about immediate PASID reuse after a process exits, where the GPU can...

The Linux kernel’s networking stack has a new memory-safety problem on its hands, and this one sits in an especially sensitive place: AF_PACKET fanout teardown. CVE-2026-31504 describes a race in packet_release where a concurrent NETDEV_UP event can re-register a socket into a fanout group after...