CVE-2026-64312

In the Linux kernel, the following vulnerability has been resolved: crypto: pcrypt - restore callback for non-parallel fallback pcrypt installs pcryptaeaddone on the child AEAD request before trying to submit it through padata. If padatadoparallel returns -EBUSY, pcrypt falls back to calling the...

CVE-2026-64310

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for SEV ioctls Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and zero o...

CVE-2026-64309

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCOMMIT Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64308

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPVLEKLOAD Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and...

CVE-2026-64307

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Do not initialize SNP for ioctlSNPCONFIG Sashiko notes: if SEV initialization fails and KVM is actively running normal VMs, could a userspace process trigger this code path via /dev/sev ioctls e.g., SEVPDHGEN and ze...

CVE-2026-64306

In the Linux kernel, the following vulnerability has been resolved: crypto: drbg - Fix returning success on failure in CTRDRBG drbgctrgenerate sometimes returns success when it fails, leaving the output buffer uninitialized. Fix it...

CVE-2026-64305

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - protect service table iterations with servicelock The servicetable list is protected by servicelock when entries are added or removed in adfserviceadd and adfserviceremove, but several functions iterate over the lis...

CVE-2026-64304

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - validate RSA CRT component lengths The generic RSA key parser rsahelper.c bounds each CRT component p, q, dp, dq, qinv by the modulus size nsz, but qatrsasetkeycrt allocates half-size DMA buffers keysz / 2 and...

CVE-2026-64303

In the Linux kernel, the following vulnerability has been resolved: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path When dmaengineprepslavesg fails for the TX channel, the error path terminates the TX DMA channel but leaves the RX channel running. Since the RX channel was...

CVE-2026-64302

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix freeing of PMD-sized vmemmap pages Commit bf9e4e30f353 "x86/mm: use pagetablefree", switched from freeing non-boot page tables through freepages to pagetablefree. However, the function is also called to free vmemmap...

CVE-2026-64300

In the Linux kernel, the following vulnerability has been resolved: perf/aux: Fix page UAF in maprange maprange reads rb-auxpages, rb-auxnrpages and rb-auxpgoff via perfmmaptopage while holding only event-mmapmutex. Those fields are serialized by rb-auxmutex, and mmapmutex is per event. Thus, two...

CVE-2026-64301

In the Linux kernel, the following vulnerability has been resolved: regulator: scmi: fix ofnode refcount leak in scmiregulatorprobe scmiregulatorprobe calls offindnodebyname which takes a reference on the returned device node. On the error path where processscmiregulatorofnode fails, the function...

CVE-2026-64299

In the Linux kernel, the following vulnerability has been resolved: tracing: Prevent out-of-bounds read in glob matching String event fields are not necessarily NUL-terminated, so the filter predicate functions filterpredstring, filterpredstrloc and filterpredstrrelloc pass the field length to th...

CVE-2026-64297

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64296

In the Linux kernel, the following vulnerability has been resolved: exfat: bound uniname advance in exfatfinddirentry In exfatfinddirentry, each TYPEEXTEND file name entry advances the output pointer by a fixed amount while the loop guard only tracks the accumulated name length: if ++order == 2...

CVE-2026-64295

In the Linux kernel, the following vulnerability has been resolved: mm: pageext: add count limit to pageextiternext to prevent invalid PFN access The pageext iteration API does not validate if the PFN still belongs to a valid section while advancing the iterator. When dynamically adding memory in...

CVE-2026-64294

In the Linux kernel, the following vulnerability has been resolved: mm: do file ownership checks with the proper mount idmap Ever since idmapped mounts were introduced, inode ownership checks for side-channel protection in mincore and madviseMADVPAGEOUT were done against the nopmntidmap, which...

CVE-2026-64293

In the Linux kernel, the following vulnerability has been resolved: iommufd: Use sizeofhdr instead of sizeofhdr in veventq read The bound-check in iommufdveventqfopsread for the normal vEVENT path uses sizeofhdr where the surrounding code uses sizeofhdr: if !veventforlosteventsheadercur &&...

CVE-2026-64292

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64291

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventqdepth upper bound iommufdveventqalloc accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust...