CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2026-43361 – btrfs: fix transaction abort when snapshotting received subvolumes
https://notcve.org/view.php?id=CVE-2026-43361
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort when snapshotting received subvolumes Currently a user can trigger a transaction abort by snapshotting a previously received snapshot a bunch of times until we reach a BTRFS_UUID_KEY_RECEIVED_SUBVOL item overflow (the maximum item size we can store in a leaf). This is very likely not common in practice, but if it happens, it turns the filesystem into RO mode. The snapshot, send and set_received_subvol and subvol... • https://git.kernel.org/stable/c/dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2026-43359 – btrfs: fix transaction abort on set received ioctl due to item overflow
https://notcve.org/view.php?id=CVE-2026-43359
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction abort on set received ioctl due to item overflow If the set received ioctl fails due to an item overflow when attempting to add the BTRFS_UUID_KEY_RECEIVED_SUBVOL we have to abort the transaction since we did some metadata updates before. This means that if a user calls this ioctl with the same received UUID field for a lot of subvolumes, we will hit the overflow, trigger the transaction abort and turn the filesystem ... • https://git.kernel.org/stable/c/dd5f9615fc5c5e8d3751aab3a17b92768fb1ce70 • CWE-191: Integer Underflow (Wrap or Wraparound) •
CVSS: 5.5EPSS: 0%CPEs: 8EXPL: 0CVE-2026-43357 – iio: gyro: mpu3050-core: fix pm_runtime error handling
https://notcve.org/view.php?id=CVE-2026-43357
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: iio: gyro: mpu3050-core: fix pm_runtime error handling The return value of pm_runtime_get_sync() is not checked, allowing the driver to access hardware that may fail to resume. The device usage count is also unconditionally incremented. Use pm_runtime_resume_and_get() which propagates errors and avoids incrementing the usage count on failure. In preenable, add pm_runtime_put_autosuspend() on set_8khz_samplerate() failure since postdisable d... • https://git.kernel.org/stable/c/3904b28efb2c780c23dcddfb87e07fe0230661e5 •
CVSS: 5.5EPSS: 0%CPEs: 6EXPL: 0CVE-2026-43355 – iio: light: bh1780: fix PM runtime leak on error path
https://notcve.org/view.php?id=CVE-2026-43355
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: iio: light: bh1780: fix PM runtime leak on error path Move pm_runtime_put_autosuspend() before the error check to ensure the PM runtime reference count is always decremented after pm_runtime_get_sync(), regardless of whether the read operation succeeds or fails. • https://git.kernel.org/stable/c/1f0477f18306c018a954e4f333690a9d0f7efc76 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.6EPSS: 0%CPEs: 5EXPL: 0CVE-2026-43350 – smb: client: require a full NFS mode SID before reading mode bits
https://notcve.org/view.php?id=CVE-2026-43350
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: smb: client: require a full NFS mode SID before reading mode bits parse_dacl() treats an ACE SID matching sid_unix_NFS_mode as an NFS mode SID and reads sid.sub_auth[2] to recover the mode bits. That assumes the ACE carries three subauthorities, but compare_sids() only compares min(a, b) subauthorities. A malicious server can return an ACE with num_subauth = 2 and sub_auth[] = {88, 3}, which still matches sid_unix_NFS_mode and then drives t... • https://git.kernel.org/stable/c/e2f8fbfb8d09c06decde162090fac3ee220aa280 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2026-43343 – usb: gadget: f_subset: Fix unbalanced refcnt in geth_free
https://notcve.org/view.php?id=CVE-2026-43343
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_subset: Fix unbalanced refcnt in geth_free geth_alloc() increments the reference count, but geth_free() fails to decrement it. This prevents the configuration of attributes via configfs after unlinking the function. Decrement the reference count in geth_free() to ensure proper cleanup. • https://git.kernel.org/stable/c/02832e56f88a981474ee4c7c141f46fc1b4454f4 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2026-43342 – usb: gadget: f_rndis: Protect RNDIS options with mutex
https://notcve.org/view.php?id=CVE-2026-43342
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f_rndis: Protect RNDIS options with mutex The class/subclass/protocol options are suspectible to race conditions as they can be accessed concurrently through configfs. Use existing mutex to protect these options. This issue was identified during code inspection. • https://git.kernel.org/stable/c/73517cf49bd449122b615d2b7a6bb835f02252e5 •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2026-43340 – comedi: Reinit dev->spinlock between attachments to low-level drivers
https://notcve.org/view.php?id=CVE-2026-43340
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: comedi: Reinit dev->spinlock between attachments to low-level drivers `struct comedi_device` is the main controlling structure for a COMEDI device created by the COMEDI subsystem. It contains a member `spinlock` containing a spin-lock that is initialized by the COMEDI subsystem, but is reserved for use by a low-level driver attached to the COMEDI device (at least since commit 25436dc9d84f ("Staging: comedi: remove RT code")). Some COMEDI de... • https://git.kernel.org/stable/c/ed9eccbe8970f6eedc1b978c157caf1251a896d4 •
CVSS: 7.8EPSS: 0%CPEs: 8EXPL: 0CVE-2026-43339 – ipv6: prevent possible UaF in addrconf_permanent_addr()
https://notcve.org/view.php?id=CVE-2026-43339
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent possible UaF in addrconf_permanent_addr() The mentioned helper try to warn the user about an exceptional condition, but the message is delivered too late, accessing the ipv6 after its possible deletion. Reorder the statement to avoid the possible UaF; while at it, place the warning outside the idev->lock as it needs no protection. • https://git.kernel.org/stable/c/f1705ec197e705b79ea40fe7a2cc5acfa1d3bfac •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2026-43338 – btrfs: reserve enough transaction items for qgroup ioctls
https://notcve.org/view.php?id=CVE-2026-43338
08 May 2026 — In the Linux kernel, the following vulnerability has been resolved: btrfs: reserve enough transaction items for qgroup ioctls Currently our qgroup ioctls don't reserve any space, they just do a transaction join, which does not reserve any space, neither for the quota tree updates nor for the delayed refs generated when updating the quota tree. The quota root uses the global block reserve, which is fine most of the time since we don't expect a lot of updates to the quota root, or to be too close to -ENOSPC s... • https://git.kernel.org/stable/c/5d13a37bd5327220e13329943d1228acfbe5934a •