CVE-2026-98781 drm/mediatek: Fix pdev reference leak in mtk_drm_bind()

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex device via offinddevicebynode, without ever dropping it: mtkdrmunbin...

CVE-2026-98781

The Linux kernel contains a pdev reference leak within the drm/mediatek driver. Specifically, the mtk_drm_bind() function incorrectly retains a reference on the disp-mutex device when called via of_find_device_by_node() for devices that are not the mmsys master . Because the reference is not drop...

EUVD-2026-103866

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex device via offinddevicebynode, without ever dropping it: mtkdrmunbin...

EUVD-2026-103865

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

CVE-2026-98780

The Linux kernel contains a memory leak vulnerability within the drm/amdgpu driver. Specifically, the amdgpu_discovery_sysfs_ips() function allocates an ip_hw_instance using kzalloc_flex() and initializes an embedded kobject, but fails to handle errors correctly when calling kobject_add(). If kob...

CVE-2026-98780 drm/amdgpu: fix IP instance memory leak on kobject add failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

EUVD-2026-103864

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

CVE-2026-98779

The Linux kernel contains a device leak vulnerability in the drm/amdgpu driver. The acp_hw_init() function registers ACP child devices using mfd_add_devices() before completing hardware initialization. If attaching a child to the power domain fails, or if reset/clock enable operations time out, t...

CVE-2026-98779 drm/amdgpu: fix ACP MFD device leak on init failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

EUVD-2026-103863

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

CVE-2026-98778 binder: fix is_failure flag for superseded transaction cleanup

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

CVE-2026-98778

The Linux kernel 's binder driver contains a vulnerability where a TF_UPDATE_TXN transaction superseding a pending async transaction incorrectly sets the is_failure flag to false. Because the transaction was never delivered, binder_apply_fd_fixups() is skipped, leaving stale buffer contents. The ...

CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98777

The Linux kernel contains a memory leak vulnerability within the binder component. When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed using kfree() directly. This process omits the necessary call to binder_free_txn_fixups...

EUVD-2026-103862

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98776 binderfs: fix UAF write in binder_add_device

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

CVE-2026-98776

The Linux kernel contains a Use-After-Free (UAF) write vulnerability in the binderfs component. The issue occurs because binderfs_binder_device_create() publishes a new dentry but drops the parent directory lock and the creator's dentry reference before calling binder_add_device(). A concurrent u...

EUVD-2026-103861

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

CVE-2026-98775 nitro_enclaves: fix use-after-free on SLOT_ALLOC failure

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure When necreatevmioctl fails the SLOTALLOC request after anoninodegetfile has succeeded, the error path calls fputenclavefile and then frees neenclave. In normal userspace...

CVE-2026-98775

The Linux kernel contains a use-after-free vulnerability in the nitro_enclaves component. Specifically, when ne_create_vm_ioctl() fails a SLOT_ALLOC request after anon_inode_getfile() succeeds, the error path calls fput(enclave_file) and then frees ne_enclave. Because fput() defers the final dest...