CVE-2026-31532

A flaw in the Linux kernel's NTFS3 LZNT decompression path can expose uninitialized kernel page contents when reading a crafted compressed file. Bynario demonstrated that the disclosure can recover kernel pointers and determine the randomized kernel base, defeating KASLR and providing information useful for follow-on exploitation.

The Linux kernel's NFC/NCI subsystem can expose uninitialized kernel stack memory when processing crafted RF discovery or interface-activation notifications with zero-length technology-specific parameters. The affected handlers pass uninitialized data into NFC target records that can later be returned to user space.

The Linux kernel's NFC/NCI subsystem can write beyond its fixed-size discovered-target array when an NFC controller repeatedly restarts discovery and reports automatically activated targets. The unchecked target count causes a kernel heap out-of-bounds write and can also make subsequent code walk beyond the array.