CVE-2026-98397

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98395

In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...

CVE-2026-98389

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip gfx switchpowerprofile during GPU reset During resume from GPU reset, the gfx idle work may invoke switchpowerprofile before the reset completes. This causes the following assert error because the register access...

CVE-2026-98391

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Guard page-fault worker with runtime PM check During VM teardown, the VM's runtime PM reference is dropped asynchronously, allowing the device to autosuspend while stale page faults belonging to the now-dead VM are still...

CVE-2026-98390

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Avoid divide by zero on virtualized systems On a virtualized system, the number of nodes does not have a relationship to the number of roots. A Xen PVH dom0 can calculate rootspernode as 0, which crashes with a divid...

CVE-2026-98386

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Use memsetio to clear QLAFX00 request ring slot For QLAFX00 the request ring is ioremapped device I/O memory ha-iobase + reqqueoff, not DMA-coherent RAM, which is why the rest of the FX00 path accesses it through...

CVE-2026-98387

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix skcipherwalk return code handling in aess390 The return codes from skcipherwalkvirt were not properly checked before entering the processing loops in ecbaescrypt and ctraescrypt. If skcipherwalkvirt fails, the wa...

CVE-2026-98388

In the Linux kernel, the following vulnerability has been resolved: exec: docloseonexec before taking execupdatelock docloseonexec currently happens while holding the execupdatelock, which is used in a lot of places that access process state to synchronize access checks. I recently added another...

dirtypipez-exploit

CVE-2022-0847 DirtyPipe Exploit. Credit: Max Kellermann [email protected] A new Linux vulnerability known as 'Dirty Pipe' allows local users to gain root privileges through publicly available exploits. Today, security researcher Max Kellermann responsibly disclosed the 'Dirty Pipe'...

CVE-2021-4154

CVE-2021-4154 This bug was fix in https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3b0462726e7ef281c35a7a4ae33e93ee2bc9975b This exploit works on most pre-patch kernels for: CentOS 8 kernels higher than linux-4.18.0-305.el8 Debian 11 kernels higher than 5.10.0-8 Fedor...

KNOXout

KNOXout A PoC of Galaxy S6 rooting based on the CVE-2016-6584 vulnerability It uses iovyroot by dosomder/idler1984 for initial kernel write-what-where vulnerability...

CVE-2026-98431

The Linux kernel RDMA/uverbs component contains a circular locking dependency (ABBA deadlock) involving the mmap_lock and disassociation_lock. The issue was triggered by a commit that introduced disassociation_lock to protect new mmap registrations against uverbs_user_mmap_disassociate(). Specifi...

CVE-2026-98431 RDMA/uverbs: Fix mmap_lock/disassociation_lock circular dependency

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmaplock/disassociationlock circular dependency Commit 51976c6cd786 "RDMA/core: Provide rdmausermmapdisassociate to disassociate mmap pages" introduced disassociationlock to protect new mmap registrations against...

EUVD-2026-101024

In the Linux kernel, the following vulnerability has been resolved: RDMA/uverbs: Fix mmaplock/disassociationlock circular dependency Commit 51976c6cd786 "RDMA/core: Provide rdmausermmapdisassociate to disassociate mmap pages" introduced disassociationlock to protect new mmap registrations against...

CVE-2026-98430

A vulnerability exists in the Linux kernel 's RDMA/efa driver where the management IRQ handler accessed the admin completion queue and async event queue before they were fully constructed or after they were destroyed. This occurs because the driver registered the IRQ while the queues were in an i...

EUVD-2026-101079

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-98430 RDMA/efa: Keep admin queues alive while IRQ is registered

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep admin queues alive while IRQ is registered The management IRQ handler accesses both the admin completion queue and the async event queue. The driver registered the IRQ before constructing these queues and destroyed...

CVE-2026-98429

The Linux kernel contains a vulnerability in the RDMA/efa subsystem where the completion IRQ handler accesses the EQ state and DMA buffer prematurely. The root cause is that the IRQ was registered before the state was initialized, and during teardown, the buffer was released before the handler wa...

CVE-2026-98428 ALSA: usb: 6fire: Avoid embedded URBs

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb: 6fire: Avoid embedded URBs The USB 6fire driver uses URBs embedded in different structs for PCM, MIDI and communication, and this is basically a buggy implementation nowadays; since a URB is managed with a refcount, th...

CVE-2026-98429 RDMA/efa: Keep EQ resources alive while IRQ is registered

In the Linux kernel, the following vulnerability has been resolved: RDMA/efa: Keep EQ resources alive while IRQ is registered The completion IRQ handler accesses the EQ state and DMA buffer. Its IRQ was registered before that state was initialized, while teardown released the buffer before freeir...