CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2026-23214 – btrfs: reject new transactions if the fs is fully read-only
https://notcve.org/view.php?id=CVE-2026-23214
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: btrfs: reject new transactions if the fs is fully read-only [BUG] There is a bug report where a heavily fuzzed fs is mounted with all rescue mount options, which leads to the following warnings during unmount: BTRFS: Transaction aborted (error -22) Modules linked in: CPU: 0 UID: 0 PID: 9758 Comm: repro.out Not tainted 6.19.0-rc5-00002-gb71e635feefc #7 PREEMPT(full) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2... • https://git.kernel.org/stable/c/a928eecf030a9a5dc5f5ca98332699f379b91963 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2026-23215 – x86/vmware: Fix hypercall clobbers
https://notcve.org/view.php?id=CVE-2026-23215
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: x86/vmware: Fix hypercall clobbers Fedora QA reported the following panic: BUG: unable to handle page fault for address: 0000000040003e54 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20251119-3.fc43 11/19/2025 RIP: 0010:vmware_hypercall4.constprop.0+0x52/0x90 .. Call Trace: vmmouse_report_events+0x13e/0x1b0 psmouse_handle_byte+0x15/0x60 p... • https://git.kernel.org/stable/c/2f467a92df61eb516a4ec36ee16234dd4e5ccf00 •
CVSS: -EPSS: %CPEs: 7EXPL: 0CVE-2026-23216 – scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
https://notcve.org/view.php?id=CVE-2026-23216
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() In iscsit_dec_conn_usage_count(), the function calls complete() while holding the conn->conn_usage_lock. As soon as complete() is invoked, the waiter (such as iscsit_close_connection()) may wake up and proceed to free the iscsit_conn structure. If the waiter frees the memory before the current thread reaches spin_unlock_bh(), it results in a KASAN slab-use-after-free a... • https://git.kernel.org/stable/c/ba684191437380a07b27666eb4e72748be1ea201 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2026-23220 – ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
https://notcve.org/view.php?id=CVE-2026-23220
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths The problem occurs when a signed request fails smb2 signature verification check. In __process_request(), if check_sign_req() returns an error, set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called. set_smb2_rsp_status() set work->next_smb2_rcv_hdr_off as zero. By resetting next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain is lost. Co... • https://git.kernel.org/stable/c/5accdc5b7f28a81bbc5880ac0b8886e60c86e8c8 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2026-23222 – crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly
https://notcve.org/view.php?id=CVE-2026-23222
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: crypto: omap - Allocate OMAP_CRYPTO_FORCE_COPY scatterlists correctly The existing allocation of scatterlists in omap_crypto_copy_sg_lists() was allocating an array of scatterlist pointers, not scatterlist objects, resulting in a 4x too small allocation. Use sizeof(*new_sg) to get the correct object size. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or informatio... • https://git.kernel.org/stable/c/6edf8df4bd29f7bfd245b67b2c31d905f1cfc14b •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2026-23223 – xfs: fix UAF in xchk_btree_check_block_owner
https://notcve.org/view.php?id=CVE-2026-23223
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: xfs: fix UAF in xchk_btree_check_block_owner We cannot dereference bs->cur when trying to determine if bs->cur aliases bs->sc->sa.{bno,rmap}_cur after the latter has been freed. Fix this by sampling before type before any freeing could happen. The correct temporal ordering was broken when we removed xfs_btnum_t. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or inf... • https://git.kernel.org/stable/c/1d411278dda293a507cb794db7d9ed3511c685c6 •
CVSS: -EPSS: %CPEs: 3EXPL: 0CVE-2026-23224 – erofs: fix UAF issue for file-backed mounts w/ directio option
https://notcve.org/view.php?id=CVE-2026-23224
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222] filemap_read_folio+... • https://git.kernel.org/stable/c/ae385826840a3c8e09bf38cac90adcd690716f57 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2026-23228 – smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
https://notcve.org/view.php?id=CVE-2026-23228
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection() On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is freed via free_transport(), which does not decrement active_num_conn, leaking this counter. Replace free_transport() with ksmbd_tcp_disconnect(). Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the ... • https://git.kernel.org/stable/c/787769c8cc50416af7b8b1a36e6bcd6aaa7680aa •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2026-23229 – crypto: virtio - Add spinlock protection with virtqueue notification
https://notcve.org/view.php?id=CVE-2026-23229
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: crypto: virtio - Add spinlock protection with virtqueue notification When VM boots with one virtio-crypto PCI device and builtin backend, run openssl benchmark command with multiple processes, such as openssl speed -evp aes-128-cbc -engine afalg -seconds 10 -multi 32 openssl processes will hangup and there is error reported like this: virtio_crypto virtio0: dataq.0:id 3 is not a head! It seems that the data virtqueue need protection when it... • https://git.kernel.org/stable/c/d6f0d586808689963e58fd739bed626ff5013b24 •
CVSS: -EPSS: %CPEs: 4EXPL: 0CVE-2026-23230 – smb: client: split cached_fid bitfields to avoid shared-byte RMW races
https://notcve.org/view.php?id=CVE-2026-23230
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: smb: client: split cached_fid bitfields to avoid shared-byte RMW races is_open, has_lease and on_list are stored in the same bitfield byte in struct cached_fid but are updated in different code paths that may run concurrently. Bitfield assignments generate byte read–modify–write operations (e.g. `orb $mask, addr` on x86_64), so updating one flag can restore stale values of the others. A possible interleaving is: CPU1: load old byte (has_lea... • https://git.kernel.org/stable/c/4386f6af8aaedd0c5ad6f659b40cadcc8f423828 •