CVE-2026-63989 bridge: Fix sleep in atomic context in netlink path

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in netlink path Since the introduction of the netlink configuration path for bridge ports in commit 25c71c75ac87 "bridge: bridge port parameters over netlink", brsetport was always called with...

CVE-2026-63988

CVE-2026-63988 concerns a Linux kernel fix for sleeping in atomic context during sysfs path handling in bridge brport_store(). The root cause: brport_store() previously held the bridge lock for many attributes; now most attributes don’t require the lock. As a result, calling dev_set_promiscuity()...

EUVD-2026-45561

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brportstore always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its...

CVE-2026-63988 bridge: Fix sleep in atomic context in sysfs path

In the Linux kernel, the following vulnerability has been resolved: bridge: Fix sleep in atomic context in sysfs path Since the start of the git history, brportstore always acquired the bridge lock. Back then this decision made sense: The bridge lock protects the STP state of the bridge and its...

EUVD-2026-45747

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Set HCICMDDRAINWORKQUEUE during device close Since hcidevclosesync can now be called during the reset path, we should also set HCICMDDRAINWORKQUEUE. This avoids queuing timeouts while the hdev workqueue is bei...

EUVD-2026-45741

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6selectpath Found while auditing the same pattern Sashiko reported in rt6fillnode 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers...

CVE-2026-63968

In CVE-2026-63968, the Linux kernel fixes an infinite loop in IPv6 path selection (fib6_select_path). The advisory notes that writers holding tb6_lock could list_del_rcu(&first->fib6_siblings) without waiting for RCU readers, causing first->fib6_siblings.next to reference the old ring and a...

CVE-2026-63968

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in fib6selectpath Found while auditing the same pattern Sashiko reported in rt6fillnode 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers...

EUVD-2026-45740

In the Linux kernel, the following vulnerability has been resolved: iio: imu: stlsm6dsx: fix stack leak in tagged FIFO buffer The tagged FIFO path declares iiobuff on the stack with aligned8 but no initializer, but there is a hole in the structure, which will then leak to userspace as...

EUVD-2026-45728

In the Linux kernel, the following vulnerability has been resolved: mm/vmalloc: do not trigger BUG on BH disabled context getvmareanode currently triggers a BUG if ininterrupt returns true. However, ininterrupt also reports true when BH are disabled. The bridge code can call...

CVE-2026-63953 mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: fix pgtable leak in migratevmainserthugepmdpage When migratevmainserthugepmdpage jumps to unlockabort due to a PMD check failure, the pgtable allocated earlier via pteallocone is never freed, causing a memory...

EUVD-2026-45703

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

CVE-2026-63930

CVE-2026-63930 — Linux kernel iio: buffer: hw-consumer : The use-after-free occurs in the err_put_buffers cleanup path of iio_hw_consumer_alloc(), where the code used list_for_each_entry() to call iio_buffer_put() on each buffer. If a buffer’s refcount dropped to 0, iio_buffer_put() could free th...

CVE-2026-63930 iio: buffer: hw-consumer: fix use-after-free in error path

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

CVE-2026-63930

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

EUVD-2026-45685

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63907

In the Linux kernel, the following vulnerability has been resolved: uio: uiopcigenericsva: fix double free of devmkzalloc memory uiopcisva allocates struct uiopcisvadev with devmkzalloc in probe, but then calls kfreeudev both on the probe error path label outfree and again in remove. Because...

CVE-2026-63905 usbip: vudc: Fix use after free bug in vudc_remove due to race condition

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

CVE-2026-63905 usbip: vudc: Fix use after free bug in vudc_remove due to race condition

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...