CVSS: 7.4EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23364 – ksmbd: Compare MACs in constant time
https://notcve.org/view.php?id=CVE-2026-23364
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC comparisons need to be constant-time. Replace the memcmp() with the correct function, crypto_memneq(). • https://git.kernel.org/stable/c/e2f34481b24db2fd634b5edb0a5bd0e4d38cc6e9 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2026-23363 – wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211()
https://notcve.org/view.php?id=CVE-2026-23363
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80211() Check frame length before accessing the mgmt fields in mt7925_mac_write_txwi_80211 in order to avoid a possible oob access. • https://git.kernel.org/stable/c/c948b5da6bbec742b433138e3e3f9537a85af2e5 •
CVSS: -EPSS: 0%CPEs: 10EXPL: 0CVE-2026-23362 – can: bcm: fix locking for bcm_op runtime updates
https://notcve.org/view.php?id=CVE-2026-23362
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 ("can: bcm: add locking for bcm_op runtime updates") added a locking for some variables that can be modified at runtime when updating the sending bcm_op with a new TX_SETUP command in bcm_tx_setup(). Usually the RX_SETUP only handles and filters incoming traffic with one exception: When the RX_RTR_FRAME flag is set a predefined CAN frame is sent when a specific RTR frame i... • https://git.kernel.org/stable/c/2a437b86ac5a9893c902f30ef66815bf13587bf6 •
CVSS: -EPSS: 0%CPEs: 4EXPL: 0CVE-2026-23361 – PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry
https://notcve.org/view.php?id=CVE-2026-23361
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry Endpoint drivers use dw_pcie_ep_raise_msix_irq() to raise an MSI-X interrupt to the host using a writel(), which generates a PCI posted write transaction. There's no completion for posted writes, so the writel() may return before the PCI write completes. dw_pcie_ep_raise_msix_irq() also unmaps the outbound ATU entry used for the PCI write, so the write races with the unmap. If t... • https://git.kernel.org/stable/c/beb4641a787df79a1423a8789d185b6b78fcbfea •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2026-23360 – nvme: fix admin queue leak on controller reset
https://notcve.org/view.php?id=CVE-2026-23360
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). • https://git.kernel.org/stable/c/a505f0ba36ab24176c300d7ff56aff85c2977e6c •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23359 – bpf: Fix stack-out-of-bounds write in devmap
https://notcve.org/view.php?id=CVE-2026-23359
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: bpf: Fix stack-out-of-bounds write in devmap get_upper_ifindexes() iterates over all upper devices and writes their indices into an array without checking bounds. Also the callers assume that the max number of upper devices is MAX_NEST_DEV and allocate excluded_devices[1+MAX_NEST_DEV] on the stack, but that assumption is not correct and the number of upper devices could be larger than MAX_NEST_DEV (e.g., many macvlans), causing a stack-out-... • https://git.kernel.org/stable/c/aeea1b86f9363f3feabb496534d886f082a89f21 •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23357 – can: mcp251x: fix deadlock in error path of mcp251x_open
https://notcve.org/view.php?id=CVE-2026-23357
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: can: mcp251x: fix deadlock in error path of mcp251x_open The mcp251x_open() function call free_irq() in its error path with the mpc_lock mutex held. But if an interrupt already occurred the interrupt handler will be waiting for the mpc_lock and free_irq() will deadlock waiting for the handler to finish. This issue is similar to the one fixed in commit 7dd9c26bd6cf ("can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open") but... • https://git.kernel.org/stable/c/bf66f3736a945dd4e92d86427276c6eeab0a6c1d •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23356 – drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
https://notcve.org/view.php?id=CVE-2026-23356
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock() Even though we check that we "should" be able to do lc_get_cumulative() while holding the device->al_lock spinlock, it may still fail, if some other code path decided to do lc_try_lock() with bad timing. If that happened, we logged "LOGIC BUG for enr=...", but still did not return an error. The rest of the code now assumed that this request has references for the relevant activity log ext... • https://git.kernel.org/stable/c/08a1ddab6df7d3c7b6341774cb1cf4b21b96a214 •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2026-23352 – x86/efi: defer freeing of boot services memory
https://notcve.org/view.php?id=CVE-2026-23352
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: x86/efi: defer freeing of boot services memory efi_free_boot_services() frees memory occupied by EFI_BOOT_SERVICES_CODE and EFI_BOOT_SERVICES_DATA using memblock_free_late(). There are two issue with that: memblock_free_late() should be used for memory allocated with memblock_alloc() while the memory reserved with memblock_reserve() should be freed with free_reserved_area(). More acutely, with CONFIG_DEFERRED_STRUCT_PAGE_INIT=y efi_free_boo... • https://git.kernel.org/stable/c/0aed459e8487eb6ebdb4efe8cefe1eafbc704b30 •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23351 – netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
https://notcve.org/view.php?id=CVE-2026-23351
25 Mar 2026 — In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. ... • https://git.kernel.org/stable/c/3c4287f62044a90e73a561aa05fc46e62da173da •