CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2026-23227 – drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free
https://notcve.org/view.php?id=CVE-2026-23227
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: drm/exynos: vidi: use ctx->lock to protect struct vidi_context member variables related to memory alloc/free Exynos Virtual Display driver performs memory alloc/free operations without lock protection, which easily causes concurrency problem. For example, use-after-free can occur in race scenario like this: ``` CPU0 CPU1 CPU2 ---- ---- ---- vidi_connection_ioctl() if (vidi->connection) // true drm_edid = drm_edid_alloc(); // alloc drm_edid ... • https://git.kernel.org/stable/c/d3b62dbfc7b9bb013926f56db79b60f6c18c392f •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2026-23226 – ksmbd: add chann_lock to protect ksmbd_chann_list xarray
https://notcve.org/view.php?id=CVE-2026-23226
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: ksmbd: add chann_lock to protect ksmbd_chann_list xarray ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del). Adds rw_semaphore chann_lock to struct ksmbd_session and protects all xa_load/xa_store/xa_erase accesses. • https://git.kernel.org/stable/c/1d9c4172110e645b383ff13eee759728d74f1a5d •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2026-23221 – bus: fsl-mc: fix use-after-free in driver_override_show()
https://notcve.org/view.php?id=CVE-2026-23221
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: bus: fsl-mc: fix use-after-free in driver_override_show() The driver_override_show() function reads the driver_override string without holding the device_lock. However, driver_override_store() uses driver_set_override(), which modifies and frees the string while holding the device_lock. This can result in a concurrent use-after-free if the string is freed by the store function while being read by the show function. Fix this by holding the d... • https://git.kernel.org/stable/c/1f86a00c1159fd77e66b1bd6ff1a183f4d46f34d •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2025-71227 – wifi: mac80211: don't WARN for connections on invalid channels
https://notcve.org/view.php?id=CVE-2025-71227
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't WARN for connections on invalid channels It's not clear (to me) how exactly syzbot managed to hit this, but it seems conceivable that e.g. regulatory changed and has disabled a channel between scanning (channel is checked to be usable by cfg80211_get_ies_channel_number) and connecting on the channel later. With one scenario that isn't covered elsewhere described above, the warning isn't good, replace it with a (more in... • https://git.kernel.org/stable/c/f2d9d270c15ae0139b54a7e7466d738327e97e03 •
CVSS: -EPSS: 0%CPEs: 2EXPL: 0CVE-2025-71226 – wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP
https://notcve.org/view.php?id=CVE-2025-71226
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: Implement settime64 as stub for MVM/MLD PTP Since commit dfb073d32cac ("ptp: Return -EINVAL on ptp_clock_register if required ops are NULL"), PTP clock registered through ptp_clock_register is required to have ptp_clock_info.settime64 set, however, neither MVM nor MLD's PTP clock implementation sets it, resulting in warnings when the interface starts up, like WARNING: drivers/ptp/ptp_clock.c:325 at ptp_clock_register+0x2c8/0x... • https://git.kernel.org/stable/c/ff6892ea544c4052dd5799f675ebc20419953801 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2026-23212 – bonding: annotate data-races around slave->last_rx
https://notcve.org/view.php?id=CVE-2026-23212
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: bonding: annotate data-races around slave->last_rx slave->last_rx and slave->target_last_arp_rx[...] can be read and written locklessly. Add READ_ONCE() and WRITE_ONCE() annotations. syzbot reported: BUG: KCSAN: data-race in bond_rcv_validate / bond_rcv_validate write to 0xffff888149f0d428 of 8 bytes by interrupt on cpu 1: bond_rcv_validate+0x202/0x7a0 drivers/net/bonding/bond_main.c:3335 bond_handle_frame+0xde/0x5e0 drivers/net/bonding/bon... • https://git.kernel.org/stable/c/f5b2b966f032f22d3a289045a5afd4afa09f09c6 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2025-71225 – md: suspend array while updating raid_disks via sysfs
https://notcve.org/view.php?id=CVE-2025-71225
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: md: suspend array while updating raid_disks via sysfs In raid1_reshape(), freeze_array() is called before modifying the r1bio memory pool (conf->r1bio_pool) and conf->raid_disks, and unfreeze_array() is called after the update is completed. However, freeze_array() only waits until nr_sync_pending and (nr_pending - nr_queued) of all buckets reaches zero. When an I/O error occurs, nr_queued is increased and the corresponding r1bio is queued t... • https://git.kernel.org/stable/c/e2d59925221cd562e07fee38ec8839f7209ae603 •
CVSS: -EPSS: 0%CPEs: 5EXPL: 0CVE-2025-71228 – LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED
https://notcve.org/view.php?id=CVE-2025-71228
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: LoongArch: Set correct protection_map[] for VM_NONE/VM_SHARED For 32BIT platform _PAGE_PROTNONE is 0, so set a VMA to be VM_NONE or VM_SHARED will make pages non-present, then cause Oops with kernel page fault. Fix it by set correct protection_map[] for VM_NONE/VM_SHARED, replacing _PAGE_PROTNONE with _PAGE_PRESENT. Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or... • https://git.kernel.org/stable/c/046303283d02c9732a778ccdeea433a899c78cbd •
CVSS: -EPSS: 0%CPEs: 8EXPL: 0CVE-2025-71232 – scsi: qla2xxx: Free sp in error path to fix system crash
https://notcve.org/view.php?id=CVE-2025-71232
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Free sp in error path to fix system crash System crash seen during load/unload test in a loop, [61110.449331] qla2xxx [0000:27:00.0]-0042:0: Disabled MSI-X. [61110.467494] ============================================================================= [61110.467498] BUG qla2xxx_srbs (Tainted: G OE -------- --- ): Objects remaining in qla2xxx_srbs on __kmem_cache_shutdown() [61110.467501] ----------------------------------------... • https://git.kernel.org/stable/c/f352eeb75419d2b693df7cc5957f7427c2b9b3ea •
CVSS: -EPSS: 0%CPEs: 7EXPL: 0CVE-2025-71233 – PCI: endpoint: Avoid creating sub-groups asynchronously
https://notcve.org/view.php?id=CVE-2025-71233
18 Feb 2026 — In the Linux kernel, the following vulnerability has been resolved: PCI: endpoint: Avoid creating sub-groups asynchronously The asynchronous creation of sub-groups by a delayed work could lead to a NULL pointer dereference when the driver directory is removed before the work completes. The crash can be easily reproduced with the following commands: # cd /sys/kernel/config/pci_ep/functions/pci_epf_test # for i in {1..20}; do mkdir test && rmdir test; done BUG: kernel NULL pointer dereference, address: 000000... • https://git.kernel.org/stable/c/e85a2d7837622bd99c96f5bbc7f972da90c285a2 •