EUVD-2026-76679

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double endcreating on the casefold-mismatch path ovlcreatereal releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating and sets err, then falls through to the common...

CVE-2026-89767 ovl: fix double end_creating() on the casefold-mismatch path

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double endcreating on the casefold-mismatch path ovlcreatereal releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating and sets err, then falls through to the common...

CVE-2026-89767 ovl: fix double end_creating() on the casefold-mismatch path

In the Linux kernel, the following vulnerability has been resolved: ovl: fix double endcreating on the casefold-mismatch path ovlcreatereal releases the new dentry twice when the casefold consistency check fails. The SIFDIR branch calls endcreating and sets err, then falls through to the common...

CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766 pidfd: hold exec_update_lock around namespace ioctl

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

EUVD-2026-76678

In the Linux kernel, the following vulnerability has been resolved: pidfd: hold execupdatelock around namespace ioctl The PIDFDGETNAMESPACE ioctls in pidfdioctl perform a filesystem credentials ptrace access check before handing out a namespace file descriptor. The accompanying comment states tha...

CVE-2026-89766

This Linux kernel vulnerability affects the PIDFD_GET_*_NAMESPACE ioctls in pidfd_ioctl(), which perform a ptrace credentials check before handing out a namespace file descriptor. Unlike the equivalent procfs paths (proc_ns_get_link, proc_ns_readlink), the pidfd path did not hold the target task'...

CVE-2026-89764 rust: devres: fix race between concurrent revokers

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89765 timers/itimer: Zero-init old itimerval before copy to userspace

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89764 rust: devres: fix race between concurrent revokers

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89764

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89765

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

EUVD-2026-76677

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89765

CVE-2026-89765 is a Linux kernel information disclosure vulnerability in the timers/itimer subsystem. On native sparc64 , the __kernel_old_timeval struct contains a four-byte alignment hole after tv_usec (because tv_sec is 64-bit while __kernel_suseconds_t is 32-bit). The put_itimerval() function...

EUVD-2026-76676

In the Linux kernel, the following vulnerability has been resolved: rust: devres: fix race between concurrent revokers There is a potential race condition when two paths try to revoke a Devres concurrently. The driver core's devresreleaseall calls Revocable::revoke via the release callback, while...

CVE-2026-89765 timers/itimer: Zero-init old itimerval before copy to userspace

In the Linux kernel, the following vulnerability has been resolved: timers/itimer: Zero-init old itimerval before copy to userspace On native sparc64, struct kerneloldtimeval contains a four-byte hole after tvusec because tvsec is 64-bit while kernelsusecondst is 32-bit. putitimerval fills only t...

CVE-2026-89764

CVE-2026-89764 affects the Linux kernel's Rust devres (device resource) subsystem. A race condition occurs when two code paths concurrently revoke a Devres resource: the driver core's devres_release_all() calls Revocable::revoke() via the release callback, while Devres::drop() calls revoke_nosync...

CVE-2026-89763

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...

CVE-2026-89763 KEYS: trusted: Fix TPM teardown ordering

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix TPM teardown ordering trustedtpmexit drops the TPM chip reference and frees the digest array before unregistering the trusted key type. keytypelookup holds keytypessem for reading until the key operation...