CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89453

CVE-2026-89453 is a PCI device reference count leak in the Linux kernel's iommu/amd subsystem. The function iommu_call_iopf_notifier() calls pci_get_domain_bus_and_slot() which increments the device's reference count, but neither the successful iommu_report_device_fault() path nor the abort path ...

EUVD-2026-76359

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89453

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89449 iommu: Fix dev_iommu memory leak when device_add fails in iommu_mock_device_add

In the Linux kernel, the following vulnerability has been resolved: iommu: Fix deviommu memory leak when deviceadd fails in iommumockdeviceadd iommumockdeviceadd first calls iommufwspecinit, which on success allocates both dev-iommu via deviommuget and dev-iommu-fwspec. If the subsequent...

CVE-2026-89441 mmc: via-sdmmc: cancel card-detect work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

CVE-2026-89441

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: cancel card-detect work on remove Disabling the device interrupt and freeing the IRQ prevents new card-detect work from being queued, but carddetwork already queued by the handler can still run after viasdremove...

CVE-2026-89437 platform/x86: int1092: Fix potential memory leak in sar_probe()

In the Linux kernel, the following vulnerability has been resolved: platform/x86: int1092: Fix potential memory leak in sarprobe The memory allocated for devicemodeinfo in parsepackage called by sargetdata is not freed in some of the error paths in sarprobe. Fix that by converting to use device...

EUVD-2026-76326

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003 net/iucv: filter frames in afiucv_hs_rcv() by ingress device

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-81003

In the Linux kernel, the following vulnerability has been resolved: net/iucv: filter frames in afiucvhsrcv by ingress device afiucvhsrcv selects a socket from iucvsklist by matching four 8-byte name fields in the transport header alone. No check is made against the netdevice the frame arrived on...

CVE-2026-80995 net: mctp: hold a reference to the route device in mctp_route_lookup()

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

EUVD-2026-76318

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80978

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-80974 mfd: sm501: Fix potential memory leaks during remove

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix potential memory leaks during remove The memory allocated for struct sm501devdata in sm501pciprobe and sm501platprobe is not freed by the corresponding remove functions sm501pciremove and sm501platremove. Fix that...

CVE-2026-80974

In the Linux kernel, the following vulnerability has been resolved: mfd: sm501: Fix potential memory leaks during remove The memory allocated for struct sm501devdata in sm501pciprobe and sm501platprobe is not freed by the corresponding remove functions sm501pciremove and sm501platremove. Fix that...

EUVD-2026-76296

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...