EUVD-2026-82217

In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Drain RCU callbacks during module teardown devxfreesubscription can remain queued after the last DevX event file drops its module reference or an auxiliary driver detaches its devices. mlx5ib can then unload before the...

CVE-2026-93110

CVE-2026-93110 affects the Linux kernel 's RDMA/core subsystem, specifically the ib_core module. The vulnerability arises because put_gid_ndev() is queued via call_rcu(), but stopping workqueues during module unload does not drain already-queued RCU callbacks. Since synchronize_rcu() does not wai...

CVE-2026-93110 RDMA/core: Wait for RCU callbacks before unloading ib_core

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Wait for RCU callbacks before unloading ibcore putgidndev is queued with callrcu and implemented in ibcore. Stopping the workqueues does not drain callbacks already queued, so RCU could invoke it after the module code...

EUVD-2026-82216

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93108 RDMA/ipoib: Drain RCU callbacks during module teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/ipoib: Drain RCU callbacks during module teardown IPoIB reclamation completions can be signaled from inside an RCU callback. Teardown can wake before the callback returns and unload ibipoib while its code is still executing...

CVE-2026-93093 firmware: arm_scmi: Publish channel state before callbacks

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

CVE-2026-92486

CVE-2026-92486 affects the Linux kernel BPF subsystem. The root cause is a kCFI (kernel Control Flow Integrity) mismatch : BPF subprograms use the bpf_callback_t ABI, but the task work mechanism invokes the callback through a three-argument function pointer, causing a CFI violation. The fix store...

EUVD-2026-82107

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...

CVE-2026-92486 bpf: Fix CFI mismatch in task work callback

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix CFI mismatch in task work callback BPF subprograms use the bpfcallbackt ABI, but task work invokes the callback through a three-argument function pointer. This trips kCFI. Store and invoke the callback as bpfcallbackt...

CVE-2026-90302 ocfs2: synchronize heartbeat callbacks with o2net teardown

In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch of 2: Heartbeat callbacks sta...

CVE-2026-90301 ocfs2: o2hb: quiesce negotiate handlers and timeout work

In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hbregion as the private data for the NEGOTIMEOUT and NEGOAPPROVE o2net handlers as soon as makeitem creates the configfs region. The...

CVE-2026-90255 Bluetooth: hci_conn: fix the SCO setup context lifetime

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix the SCO setup context lifetime hcisetupsync queues a connhandlet with a NULL destroy callback, so the context is only freed if hcienhancedsetupsync actually runs. An entry that is cancelled instead is...

CVE-2026-90254 Bluetooth: hci_sync: free the advertising instance on the failure and cancel paths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: free the advertising instance on the failure and cancel paths advtimeoutexpire hands a kmalloced instance byte to hcicmdsyncqueue with a NULL destroy callback, and only advtimeoutexpiresync frees it. That leak...

EUVD-2026-81828

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

CVE-2026-90192 mailbox: qcom-cpucp: handle NULL data in send_data callback

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

CVE-2026-90151 NFSv4: remove callback IDR entry on client allocation failure

In the Linux kernel, the following vulnerability has been resolved: NFSv4: remove callback IDR entry on client allocation failure nfs4allocclient allocates an NFSv4.0 callback identifier before it finishes setting up the client. If any later initialization step fails, the error path frees the...

CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

CVE-2026-90140 cuse: wait for pending RCU callbacks on module exit

In the Linux kernel, the following vulnerability has been resolved: cuse: wait for pending RCU callbacks on module exit Since commit 053fc4f755ad "fuse: fix UAF in rcu pathwalks", fuseconnput frees the fuseconn through callrcu rather than synchronously. For cuse, fc-release is cusefcrelease, whic...

CVE-2026-90140

This Linux kernel vulnerability affects the cuse (Character device in Userspace) module. Since commit 053fc4f755ad, fuse_conn_put() releases the fuse_conn via call_rcu() rather than synchronously. Because fc->release points to cuse_fc_release() in the cuse module, removing the module (rmmod cu...