CVE-2026-64111

In the Linux kernel, the following vulnerability has been resolved: lsm: hold credguardmutex for lsmsetselfattr Just as procpidattrwrite already does before calling the LSM hook. This only matters for SELinux and AppArmor which check whether the process is being ptraced and if so, whether to allo...

CVE-2026-64100

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix shrinker deadlock With PROVELOCKING on an Snapdragon X1 and VM reclaim pressure, we see: ====================================================== WARNING: possible circular locking dependency detected 7.0.0-debug+ 43...

CVE-2026-64101

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-64103

In the Linux kernel, the following vulnerability has been resolved: scsi: isci: Fix use-after-free in device removal path The ISCI completion tasklet is initialized in iscihostalloc drivers/scsi/isci/init.c:496 and scheduled from both MSI-X and legacy interrupt handlers...

CVE-2026-64104

In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Explicitly leak pages in unknown state When setmemoryencrypted,decrypted fail, the user cannot know at which point the function failed, meaning that the pages are left in an unknown state from the point of view o...

CVE-2026-64106

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic-its: Reject restored DTE with out-of-range numeventidbits Userspace can restore an ITS Device Table Entry whose Size field encodes more EventID bits than the virtual ITS supports. The live MAPD path rejects that...

CVE-2026-64095

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid double decrement of bla.numrequests The bla.numrequests is increased when no requestsent was in progress. And it is decremented in various places announcement was received, backbone is purged, periodic work...

CVE-2026-64097

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate GPIO pin LUT table size before iterating Why&How The GPIO pin table parsers in getgpioi2cinfo and biosparsergetgpiopininfo derive an element count from the VBIOS tableheader.structuresize field, then...

CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64092

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: fix tpvars reference leak in receiver shutdown The receiver shutdown timer handler, batadvtpreceivershutdown, is responsible for releasing the tpvars reference it holds. However, the existing logic for...

CVE-2026-64094

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: avoid NULL-ptr deref for claim via dropped interface Without rtnllock held, a hardif might be retrieved as primary interface of a meshif, but then while operating on this interface getting decoupled from the mesh...

CVE-2026-64093

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tpmeter: directly shut down timer on cleanup batadvtpsendercleanup was calling timerdeletesync followed by timerdelete to guard against the timer handler re-arming itself between the two calls. This double-deletion ha...

CVE-2026-64098

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtiogpucursorplaneupdate and virtiogpuresourceflush lock the framebuffer BO's dmaresv via virtiogpuarraylockresv and ignore its return value. The function can fail wit...

CVE-2026-64086

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 include PEC byte in pmbusblockxfer read buffer adm1266pmbusblockxfer sets up the read transaction with .buf = data-readbuf, .len = ADM1266PMBUSBLOCKMAX + 2, but readbuf in struct adm1266data is declared as u8...

CVE-2026-64087

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject implausible blackbox recordcount adm1266nvmemreadblackbox loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data-devmem, sized for the nvm...

CVE-2026-64088

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix negative ttbufflen batadvorignode::ttbufflen was declared as s16, but the field is never intended to hold a negative value. When a value greater than 32767 is assigned, it wraps to a negative signed integer. I...

CVE-2026-64084

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

CVE-2026-64090

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: avoid empty VLAN responses The commit 16116dac2339 "batman-adv: prevent TT request storms by not sending inconsistent TT TLVLs" added checks to the local direct TT response code. But the response can also be done...

CVE-2026-64085

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 bounce blackbox records through a protocol-sized buffer adm1266pmbusblockxfer copies the device-supplied block payload into the caller-provided buffer using the device-supplied length: memcpydatar, &msgs1.buf...