huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-23111: kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check
Component: kernel
Severity: Important
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-13T00:00:00+00:00

A flaw was found in the Linux kernel's nf_tables component. A logic bug in nft_map_catchall_activate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain. A local low privileged user can exploit this to cause a denial of service or potentially achieve privilege escalation.

Statement: A logic bug in nf_tables nft_map_catchall_activate uses an inverted element active check during the abort path of a failed transaction. This can prevent re activation of catchall map elements and for NFT_GOTO verdict elements it can skip restoring the chain use reference count. Repeating an abort sequence can permanently decrement chain use until DELCHAIN frees the chain while catchall elements still reference it which can result in a use after free. For the CVSS the PR is L, but in the paranoid scenario the unprivileged users may reach nf_tables via user namespaces with delegated CAP_NET_ADMIN. The issue is not directly network reachable and is triggered by local nftables control plane operations. Impact can range from denial of service to potential privilege escalation depending on heap reuse.

Affected upstream versions: 5.15.121 < 5.15.200, 6.1.36 < 6.1.163, 4.19.316 < 4.20, 5.4.262 < 5.5, 5.10.188 < 5.11, 6.3.10 < 6.4, 6.4
Fixed upstream versions: 0, 4.20, 5.11, 5.15.200, 5.5, 6.1.163, 6.12.70, 6.18.10, 6.19, 6.4, 6.6.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 8c760ba4e36c750379d13569f23f5a6e185333f5
CVE-2026-23136: kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state
Component: kernel
Severity: Moderate
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 7.6 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's libceph OSD client. When a connection fault occurs during a sparse read, the sparse-read state is not properly reset. This allows a misbehaving or compromised Ceph OSD server, or a network adversary, to disrupt traffic. As a result, the client can misinterpret new data as a continuation of previous data, leading to a persistent failure mode, repeated errors, and continuous retry loops, effectively causing a Denial of Service (DoS) for Ceph clients performing sparse reads.

Statement: A reliability and availability issue exists in the libceph OSD client sparse read handling. The client tracks progress of a sparse read reply using a separate state machine. When a connection fault happens mid payload or when the sparse read state machine returns an error, the connection is abandoned and later reestablished and pending operations are retried. However 
the sparse read state was not reset on the fault path. As a result the client can misinterpret the beginning of a new reply as a continuation of the previous reply. This can drive the sparse read machinery into a persistent failure mode that may never recover, producing repeated error messages and repeated socket read failures, effectively preventing successful reads and causing continuous retry loops. From a threat perspective the trigger can be a misbehaving or compromised Ceph OSD server, or a network adversary able to disrupt or truncate traffic, causing fault and retry sequences. The primary impact is denial of service for Ceph clients performing sparse reads.

Affected upstream versions: 6.6
Fixed upstream versions: 0, 6.12.66, 6.18.6, 6.19, 6.6.121
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 90a60fe61908afa0eaf7f8fcf1421b9b50e5f7ff
CVE-2026-23139: kernel: netfilter: nf_conncount: update last_gc only when GC has been performed
Component: kernel
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conncount: update last_gc only when GC has been performed

Currently last_gc is being updated everytime a new connection is
tracked, that means that it is updated even if a GC wasn't performed.
With a sufficiently high packet rate, it is possible to always bypass
the GC, causing the list to grow infinitely.

Update the last_gc value only when a GC has been actually performed.

Statement: A denial of service condition can occur in the netfilter nf_conncount implementation due to incorrect tracking of the last garbage collection timestamp. The nf_conncount code maintains per bucket accounting lists and uses last_gc to decide when it should perform garbage collection of stale entries. Before this change, last_gc was updated every time a new connection 
entry was tracked. This meant the timestamp could be refreshed even when garbage collection did not actually run. Under a sufficiently high rate of new connections, an attacker can continuously refresh last_gc and effectively keep the code from ever triggering the real GC path. The result is unbounded growth of the internal conncount list, causing increased CPU overhead and eventually memory exhaustion leading to kernel level denial of service.

Affected upstream versions: 5.19
Fixed upstream versions: 0, 6.1.161, 6.12.66, 6.18.6, 6.19, 6.6.121
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2c7c71113ed6d3e2f3aca4c088f22283016ff34f
CVE-2026-23144: kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Data Access MONitor (DAMON) sysfs interface. A local attacker, typically a privileged user, could exploit a cleanup bug during DAMON context setup. If the setup fails after the attrs directory is created, stale sysfs directories are left behind. This can lead to a local denial of service, making the DAMON sysfs interface unusable until a system reboot, and potentially cause a kernel memory leak if repeatedly triggered.

Statement: A cleanup bug in the DAMON sysfs interface can leave behind stale sysfs directories when setting up a DAMON context fails after the attrs directory hierarchy has been created. The context directory setup sequence creates attrs and its subdirectories early and then proceeds to configure additional objects such as targets and schemes. If one of these later steps fails the old error path only released the attrs kobject without removing the attrs subdirectories. This leaves a partially created sysfs tree that can make the DAMON sysfs interface effectively unusable until reboot and also leaks kernel memory tied to the unremoved sysfs structures. The practical impact is local denial of service of DAMON sysfs management and a potential kernel memory leak if the failing setup path can be triggered repeatedly. Triggering the bug requires local access to the DAMON sysfs configuration interface and a way to induce setup failure. This is typically restricted to privileged users but may vary by deployment.

Affected upstream versions: 5.18
Fixed upstream versions: 0, 6.1.162, 6.12.67, 6.18.7, 6.19, 6.6.122
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: db7dfe78fc81bdd2b532d77f340fe453f2360426
CVE-2026-23146: kernel: Linux kernel: Denial of Service in Bluetooth HCI UART driver via null pointer dereference
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L)
Public date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth HCI UART driver. A race condition exists where the `hci_uart_write_work()` function may attempt to access uninitialized private data if a TTY write wakeup occurs during the protocol initialization phase. This can lead to a NULL pointer dereference, potentially causing a system crash and resulting in a Denial of Service (DoS).


Affected upstream versions: 5.10.237 < 5.10.249, 5.15.181 < 5.15.199, 6.1.135 < 6.1.162, 6.6.88 < 6.6.123, 6.12.24 < 6.12.69, 5.4.293 < 5.5, 6.13.12 < 6.14, 6.14.3 < 6.15, 6.15
Fixed upstream versions: 0, 5.10.249, 5.15.199, 5.5, 6.1.162, 6.12.69, 6.14, 6.15, 6.18.9, 6.19, 6.6.123
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: b0a900939e7e4866d9b90e9112514b72c451e873
CVE-2026-23156: kernel: Linux kernel: Information disclosure in efivarfs via incorrect error propagation
Component: kernel
Severity: Moderate
CWE: CWE-390 (Detection of Error Condition Without Action)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-02-14T00:00:00+00:00

A flaw was found in the efivarfs component of the Linux kernel. This vulnerability, an information disclosure issue, arises from incorrect error handling in the efivar_entry_get function. An unprivileged local attacker can exploit this by reading from efivarfs, potentially causing uninitialized kernel memory to be copied to userspace. This could allow the attacker to obtain sensitive kernel memory contents, which may aid in bypassing security mitigations.

Statement: A local information disclosure issue exists in efivarfs due to incorrect error propagation in efivar_entry_get. The wrapper efivar_entry_get called __efivar_entry_get to retrieve EFI variable data but always returned success 0 even when the underlying function failed. This causes callers to treat the output buffers attributes size and data as valid even though the read may not have completed. In the efivarfs file read path efivarfs_file_read this can result in copying an uninitialized or partially initialized kernel heap buffer to userspace. An unprivileged local attacker who can read from efivarfs can potentially obtain kernel memory contents. Such leaks can expose sensitive information and may be useful to bypass mitigations such as KASLR in combination with other vulnerabilities.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.162, 6.12.69, 6.18.9, 6.19, 6.6.123
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3960f1754664661a970dc9ebbab44ff93a0b4c42
CVE-2026-23168: kernel: flex_proportions: make fprop_new_period() hardirq safe
Component: kernel
Severity: Moderate
CWE: CWE-833 (Deadlock)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-14T00:00:00+00:00

A deadlock vulnerability was found in the Linux kernel's flexible proportions (fprop) code used for I/O writeback accounting. When a hardirq interrupts the seqcount write section in fprop_new_period() during softirq context, a reader in the hardirq handler can spin indefinitely waiting for the odd sequence number to become even, causing a system hang.

Statement: This deadlock primarily affects FUSE filesystems that configure maximum writeback throughput fractions. Standard local filesystems rarely trigger this condition. The issue results in a denial of service (system hang) but cannot be exploited for code execution or data compromise.

Affected upstream versions: 6.0
Fixed upstream versions: 0, 6.1.162, 6.12.69, 6.18.9, 6.19, 6.6.123
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 0acc9ba7a1b5ba4d998c5753e709be904e179b75
CVE-2026-23171: kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Public date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's bonding module. This use-after-free vulnerability occurs when a new slave device is added to the bonding array but fails during the enslave process. A local attacker can exploit this by triggering the enslave failure, which may lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow for arbitrary code execution.


Affected upstream versions: 5.15
Fixed upstream versions: 0, 6.12.90, 6.18.9, 6.19, 6.6.140
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 172dcb67dd35b162357df229d7806acc724cd469
CVE-2026-23191: kernel: ALSA: aloop: Fix racy access at PCM trigger
Component: kernel
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ALSA: aloop: Fix racy access at PCM trigger

The PCM trigger callback of aloop driver tries to check the PCM state
and stop the stream of the tied substream in the corresponding cable.
Since both check and stop operations are performed outside the cable
lock, this may result in UAF when a program attempts to trigger
frequently while opening/closing the tied stream, as spotted by
fuzzers.

For addressing the UAF, this patch changes two things:
- It covers the most of code in loopback_check_format() with
  cable->lock spinlock, and add the proper NULL checks.  This avoids
  already some racy accesses.
- In addition, now we try to check the state of the capture PCM stream
  that may be stopped in this function, which was the major pain point
  leading to UAF.


Affected upstream versions: 2.6.37
Fixed upstream versions: 0, 6.12.70, 6.18.10, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bad15420050db1803767e58756114800cce91ea4
CVE-2026-23193: kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
Component: kernel
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In iscsit_dec_session_usage_count(), the function calls complete() while
holding the sess->session_usage_lock. Similar to the connection usage count
logic, the waiter signaled by complete() (e.g., in the session release
path) may wake up and free the iscsit_session structure immediately.

This creates a race condition where the current thread may attempt to
execute spin_unlock_bh() on a session structure that has already been
deallocated, resulting in a KASAN slab-use-after-free.

To resolve this, release the session_usage_lock before calling complete()
to ensure all dereferences of the sess pointer are finished before the
waiter is allowed to proceed with deallocation.

Statement: A use after free can occur in the iSCSI target session usage count logic because iscsit_dec_session_usage_count can call complete while holding session_usage_lock. A waiting thread in the session release path can wake up and free the session structure immediately after the completion is signaled. The current thread may then attempt to unlock or otherwise access fields in a session object that has already been deallocated which can trigger a slab use after free and crash the kernel. The attack surface is adjacent network because iSCSI targets are typically reachable only inside storage or data center networks. Impact can be denial of service. A conservative assessment also considers potential confidentiality and integrity impact due to kernel memory corruption from a use after free.

Affected upstream versions: 3.1
Fixed upstream versions: 0, 5.10.250, 5.15.200, 6.1.163, 6.12.70, 6.18.10, 6.19, 6.6.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 2b64015550a13bcc72910be0565548d9a754d46d
CVE-2026-23204: kernel: net/sched: cls_u32: use skb_header_pointer_careful()
Component: kernel
Severity: Moderate
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221

Statement: An out of bounds memory access vulnerability exists in the Linux traffic control u32 classifier implementation. In u32_classify the kernel calculates offsets such as toff using key off values masks and variable offsets and then dereferences packet data using skb_header_pointer. The helper skb_header_pointer does not fully validate negative offset values. With a crafted configuration and packet layout the computed offset can become negative or otherwise invalid in a way that bypasses the existing checks and results in an out of bounds access. The most direct impact is a kernel crash causing a denial of service. Because the access pattern involves reading packet data at attacker influenced offsets it may also allow information disclosure of adjacent kernel memory and in worst cases could contribute to privilege escalation chains. Exploitation prerequisites depend on whether the system has tc u32 filters configured on a traffic path. For the CVSS the base score uses PR:L because configuring tc filters typically requires elevated privileges but can be available in containers or network namespaces with CAP_NET_ADMIN.

Affected upstream versions: 2.6.35
Fixed upstream versions: 0, 5.10.260, 5.15.209, 6.1.167, 6.12.70, 6.18.10, 6.19, 6.6.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 66e4b63d61c15de6ca5332d9ca6db59a404d7136
CVE-2026-23205: kernel: smb/client: fix memory leak in smb2_open_file()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-02-14T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's CIFS/SMB client. In the smb2_open_file() function, request buffers are not properly freed when performing direct I/O writes to a read-only SMB share. This causes slab cache objects to remain allocated, which can prevent the cifs module from unloading cleanly and lead to gradual memory exhaustion with repeated operations.

Statement: Exploitation requires mounting an SMB share and performing specific I/O patterns (direct writes to read-only exports). The memory leak manifests primarily when unloading the cifs module, making it a reliability issue rather than a readily exploitable denial of service condition.

Affected upstream versions: 6.1.141 < 6.1.163, 6.6.93 < 6.6.124, 6.12.31 < 6.12.70, 6.14.9 < 6.15, 6.15
Fixed upstream versions: 0, 6.1.163, 6.12.70, 6.15, 6.18.10, 6.19, 6.6.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 743f70406264348c0830f38409eb6c40a42fb2db
CVE-2026-23209: kernel: macvlan: fix error recovery in macvlan_common_newlink()
Component: kernel
Severity: Moderate
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-14T00:00:00+00:00

A use-after-free vulnerability was found in the macvlan driver. When creating a macvlan interface in source mode fails after the source MAC has been added to the hash table (e.g., due to an invalid interface name), the hash entry still references the freed net_device structure. Subsequent packets matching that source MAC trigger use-after-free in macvlan_forward_source().

Statement: This vulnerability can be exploited by a local user with CAP_NET_ADMIN to trigger use-after-free by creating a macvlan with an invalid name. The detailed reproducer and analysis were provided by a security researcher. This could potentially be used for privilege escalation via controlled memory corruption.

Affected upstream versions: 4.9
Fixed upstream versions: 0, 5.10.250, 5.15.200, 6.1.163, 6.12.70, 6.18.10, 6.19, 6.6.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: da5c6b8ae47e414be47e5e04def15b25d5c962dc
CVE-2026-23210: kernel: Linux kernel: Denial of Service in ice driver due to race condition during VSI rebuild
Component: kernel
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's ice network driver. A local attacker could exploit a race condition during the Virtual Station Interface (VSI) rebuild process. This flaw occurs when the Precision Time Protocol (PTP) periodic work attempts to access uninitialized memory, leading to a NULL pointer dereference. Successful exploitation results in a system crash, causing a Denial of Service (DoS).


Affected upstream versions: 6.9
Fixed upstream versions: 0, 6.12.80, 6.18.10, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ba0c7fff6616025a7d3a9e887e7ce16b06dc34b9
CVE-2026-23216: kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count()
Component: kernel
Severity: Moderate
CWE: CWE-413 (Improper Resource Locking)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-02-18T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's iSCSI target subsystem. In the iscsit_dec_conn_usage_count() function, complete() is called while still holding the conn->conn_usage_lock spinlock. The waiting thread (such as iscsit_close_connection()) may wake up immediately and free the iscsit_conn structure before the current thread executes spin_unlock_bh(), resulting in a use-after-free when attempting to release the lock on already-freed memory.

Statement: This vulnerability requires the iSCSI target subsystem to be configured and in use, which limits the attack surface to systems actively serving as iSCSI targets. The race condition is timing-dependent and requires specific connection teardown sequences to trigger. Successful exploitation could lead to kernel crash or potentially memory corruption.

Affected upstream versions: 3.1
Fixed upstream versions: 0, 5.10.250, 5.15.200, 6.1.163, 6.12.70, 6.18.10, 6.19, 6.6.124
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: ba684191437380a07b27666eb4e72748be1ea201