EUVD-2026-45725

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63952

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63952 memfd: deny writeable mappings when implying SEAL_WRITE

In the Linux kernel, the following vulnerability has been resolved: memfd: deny writeable mappings when implying SEALWRITE When SEALEXEC is added, SEALWRITE is implied to make W^X. But the implied seal is set after the check that makes sure the memfd can not have any writable mappings. This means...

CVE-2026-63950 mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nrpages to 1 at loop start in trytounmapone Initialize nrpages to 1 at the start of each loop iteration, like folioreferencedone does. Without this, nrpages computed by a previous foliounmapptebatch call can b...

CVE-2026-63950

Summary: CVE-2026-63950 pertains to the Linux kernel mm/rmap path. The issue arose from not reinitializing nr_pages at the start of each loop in try_to_unmap_one, allowing a value from a previous folio_unmap_pte_batch() to be reused in a later iteration. This could cause corruption of folio refco...

EUVD-2026-45723

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nrpages to 1 at loop start in trytounmapone Initialize nrpages to 1 at the start of each loop iteration, like folioreferencedone does. Without this, nrpages computed by a previous foliounmapptebatch call can b...

CVE-2026-63950

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nrpages to 1 at loop start in trytounmapone Initialize nrpages to 1 at the start of each loop iteration, like folioreferencedone does. Without this, nrpages computed by a previous foliounmapptebatch call can b...

CVE-2026-63950 mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nrpages to 1 at loop start in trytounmapone Initialize nrpages to 1 at the start of each loop iteration, like folioreferencedone does. Without this, nrpages computed by a previous foliounmapptebatch call can b...

EUVD-2026-45722

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length messagestore linedispdisplay unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

CVE-2026-63949

In the Linux kernel, the following vulnerability has been resolved: auxdisplay: line-display: fix OOB read on zero-length messagestore linedispdisplay unconditionally reads msgcount - 1 before checking whether count is zero, so a write of zero bytes to the message sysfs attribute hits msg-1:...

CVE-2026-63948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

EUVD-2026-45720

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

EUVD-2026-45721

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan ref leak in l2capchantimeout on !conn setchantimer takes a l2capchan reference via l2capchanhold before scheduling the delayed work. The normal path in l2capchantimeout drops this reference with...

CVE-2026-63948

The CVE affects the Linux kernel Bluetooth L2CAP stack, where l2cap_chan_timeout() leaks a l2cap_chan reference when chan->conn is NULL because the early return skips l2cap_chan_put() after __set_chan_timer() holds the reference via l2cap_chan_hold(). The fix adds the missing l2cap_chan_put() ...

CVE-2026-63947

CVE-2026-63947 concerns the Linux kernel Bluetooth HIDP path. The vulnerability arises in hidp_input_report(), which reads keyboard/mouse payloads from an skb without first ensuring skb->len has enough data. The caller hidp_recv_intr_frame() fetches the 1-byte HIDP header before dispatching to...

CVE-2026-63947 Bluetooth: HIDP: fix missing length checks in hidp_input_report()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

CVE-2026-63947

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: HIDP: fix missing length checks in hidpinputreport hidpinputreport reads keyboard and mouse payload data from an skb without first verifying that skb-len contains enough data. hidprecvintrframe pulls the 1-byte HIDP...

EUVD-2026-45719

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...

CVE-2026-63946

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix UAF in isorecvframe isorecvframe reads conn-sk under isoconnlock but releases the lock before using sk, with no reference held. A concurrent isosockkill can free sk in that window, causing use-after-free on...