CVSS: 7.8EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23178 – HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report()
https://notcve.org/view.php?id=CVE-2026-23178
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: HID: i2c-hid: fix potential buffer overflow in i2c_hid_get_report() `i2c_hid_xfer` is used to read `recv_len + sizeof(__le16)` bytes of data into `ihid->rawbuf`. The former can come from the userspace in the hidraw driver and is only bounded by HID_MAX_BUFFER_SIZE(16384) by default (unless we also set `max_buffer_size` field of `struct hid_ll_driver` which we do not). The latter has size determined at runtime by the maximum size of differen... • https://git.kernel.org/stable/c/85df713377ddc0482071c3e6b64c37bd1e48f1f1 •
CVSS: 5.6EPSS: 0%CPEs: 7EXPL: 0CVE-2026-23176 – platform/x86: toshiba_haps: Fix memory leaks in add/remove routines
https://notcve.org/view.php?id=CVE-2026-23176
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: platform/x86: toshiba_haps: Fix memory leaks in add/remove routines toshiba_haps_add() leaks the haps object allocated by it if it returns an error after allocating that object successfully. toshiba_haps_remove() does not free the object pointed to by toshiba_haps before clearing that pointer, so it becomes unreachable allocated memory. Address these memory leaks by using devm_kzalloc() for allocating the memory in question. In the Linux ke... • https://git.kernel.org/stable/c/23d0ba0c908ac10139f0351023c64198d7fc1409 •
CVSS: 7.2EPSS: 0%CPEs: 7EXPL: 0CVE-2025-71224 – wifi: mac80211: ocb: skip rx_no_sta when interface is not joined
https://notcve.org/view.php?id=CVE-2025-71224
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ocb: skip rx_no_sta when interface is not joined ieee80211_ocb_rx_no_sta() assumes a valid channel context, which is only present after JOIN_OCB. RX may run before JOIN_OCB is executed, in which case the OCB interface is not operational. Skip RX peer handling when the interface is not joined to avoid warnings in the RX path. In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ocb: skip rx_no_s... • https://git.kernel.org/stable/c/239281f803e2efdb77d906ef296086b6917e5d71 •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2025-71222 – wifi: wlcore: ensure skb headroom before skb_push
https://notcve.org/view.php?id=CVE-2025-71222
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: ensure skb headroom before skb_push This avoids occasional skb_under_panic Oops from wl1271_tx_work. In this case, headroom is less than needed (typically 110 - 94 = 16 bytes). In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: ensure skb headroom before skb_push This avoids occasional skb_under_panic Oops from wl1271_tx_work. In this case, headroom is less than needed (typically 110 - 94 = 16 by... • https://git.kernel.org/stable/c/f5fc0f86b02afef1119b523623b4cde41475bc8c •
CVSS: 6.3EPSS: 0%CPEs: 2EXPL: 0CVE-2025-71221 – dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue()
https://notcve.org/view.php?id=CVE-2025-71221
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmp_pdma: Fix race condition in mmp_pdma_residue() Add proper locking in mmp_pdma_residue() to prevent use-after-free when accessing descriptor list and descriptor contents. The race occurs when multiple threads call tx_status() while the tasklet on another CPU is freeing completed descriptors: CPU 0 CPU 1 ----- ----- mmp_pdma_tx_status() mmp_pdma_residue() -> NO LOCK held list_for_each_entry(sw, ..) DMA interrupt dma_do_tasklet(... • https://git.kernel.org/stable/c/1b38da264674d6a0fe26a63996b8f88b88c3da48 •
CVSS: 6.6EPSS: 0%CPEs: 6EXPL: 0CVE-2025-71220 – smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe()
https://notcve.org/view.php?id=CVE-2025-71220
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: smb/server: call ksmbd_session_rpc_close() on error path in create_smb2_pipe() When ksmbd_iov_pin_rsp() fails, we should call ksmbd_session_rpc_close(). Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leaks. For the stable distribution (trixie), these problems have been fixed in version 6.12.73-1. • https://git.kernel.org/stable/c/f2283680a80571ca82d710bc6ecd8f8beac67d63 •
CVSS: 7.1EPSS: 0%CPEs: 3EXPL: 0CVE-2025-71203 – riscv: Sanitize syscall table indexing under speculation
https://notcve.org/view.php?id=CVE-2025-71203
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: riscv: Sanitize syscall table indexing under speculation The syscall number is a user-controlled value used to index into the syscall table. Use array_index_nospec() to clamp this value after the bounds check to prevent speculative out-of-bounds access and subsequent data leakage via cache side channels. In the Linux kernel, the following vulnerability has been resolved: riscv: Sanitize syscall table indexing under speculation The syscall n... • https://git.kernel.org/stable/c/f0bddf50586da81360627a772be0e355b62f071e •
CVSS: 7.2EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23172 – net: wwan: t7xx: fix potential skb->frags overflow in RX path
https://notcve.org/view.php?id=CVE-2026-23172
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: fix potential skb->frags overflow in RX path When receiving data in the DPMAIF RX path, the t7xx_dpmaif_set_frag_to_skb() function adds page fragments to an skb without checking if the number of fragments has exceeded MAX_SKB_FRAGS. This could lead to a buffer overflow in skb_shinfo(skb)->frags[] array, corrupting adjacent memory and potentially causing kernel crashes or other undefined behavior. This issue was identified t... • https://git.kernel.org/stable/c/d642b012df70a76dd5723f2d426b40bffe83ac49 •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 0CVE-2026-23171 – bonding: fix use-after-free due to enslave fail after slave array update
https://notcve.org/view.php?id=CVE-2026-23171
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: bonding: fix use-after-free due to enslave fail after slave array update Fix a use-after-free which happens due to enslave failure after the new slave has been added to the array. Since the new slave can be used for Tx immediately, we can use it after it has been freed by the enslave error cleanup path which frees the allocated slave memory. Slave update array is supposed to be called last when further enslave failures are not expected. Mov... • https://git.kernel.org/stable/c/9e2ee5c7e7c35d195e2aa0692a7241d47a433d1e •
CVSS: 7.1EPSS: 0%CPEs: 7EXPL: 0CVE-2026-23170 – drm/imx/tve: fix probe device leak
https://notcve.org/view.php?id=CVE-2026-23170
14 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: drm/imx/tve: fix probe device leak Make sure to drop the reference taken to the DDC device during probe on probe failure (e.g. probe deferral) and on driver unbind. In the Linux kernel, the following vulnerability has been resolved: drm/imx/tve: fix probe device leak Make sure to drop the reference taken to the DDC device during probe on probe failure (e.g. probe deferral) and on driver unbind. • https://git.kernel.org/stable/c/fcbc51e54d2aa9d402206601f4894251049e5d77 •