CVE-2026-64509 rust: block: fix GenDisk cleanup paths

In the Linux kernel, the following vulnerability has been resolved: rust: block: fix GenDisk cleanup paths GenDiskBuilder::build still has fallible work after blkmqallocdisk, but its error path only recovers the foreign queue data. That leaks the temporary gendisk and requestqueue until later...

CVE-2026-64497 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELDGET. The...

EUVD-2026-48841

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELDGET. The...

CVE-2026-64497 iio: chemical: scd30: Cleanup initializations and fix sign-extension bug

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELDGET. The...

CVE-2026-64497

In the Linux kernel, the following vulnerability has been resolved: iio: chemical: scd30: Cleanup initializations and fix sign-extension bug Include linux/bitfield.h for FIELDGET. Create new macros for bit manipulation in combination with manual bit manipulation being replaced with FIELDGET. The...

CVE-2026-64485

The CVE-2026-64485 issue concerns the Linux kernel ALSA compress module. In snd_compr_task_new(), the driver task is allocated before validating DMA buffers and reserving file descriptors. If validation or FD reservation fails, the core frees wrappers and DMA references without invoking the drive...

CVE-2026-64485 ALSA: compress: Fix task creation error unwind

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind sndcomprtasknew allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task...

CVE-2026-64485 ALSA: compress: Fix task creation error unwind

In the Linux kernel, the following vulnerability has been resolved: ALSA: compress: Fix task creation error unwind sndcomprtasknew allocates the driver task before validating the returned DMA buffers and reserving file descriptors. When either of those later steps fails, the core frees its task...

EUVD-2026-48825

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/cs35l41: Fix firmware load work teardown cs35l41hda creates ALSA controls whose private data points at the cs35l41hda object. The firmware load control can also queue fwloadwork. Those controls are not removed on...

CVE-2026-64467

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

EUVD-2026-48811

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64467 rust_binder: use a u64 stride when cleaning up the offsets array

In the Linux kernel, the following vulnerability has been resolved: rustbinder: use a u64 stride when cleaning up the offsets array Allocation's Drop walks the offsets array bindersizet = u64 entries, cleaning up the objects, but it used usize instead of u64 for both the stride and the per-entry...

CVE-2026-64424 netpoll: fix a use-after-free on shutdown path

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

EUVD-2026-48768

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

CVE-2026-64421

CVE-2026-64421 is a use-after-free in the Linux kernel's imx8_isi driver (NXP i.MX8 Image Sensor Interface). During module removal (rmmod), mxc_isi_remove() called mxc_isi_crossbar_cleanup() before mxc_isi_v4l2_cleanup(), freeing media entity pads while the subsequent V4L2 cleanup still attempted...

CVE-2026-64421 media: nxp: imx8-isi: Fix use-after-free on remove

In the Linux kernel, the following vulnerability has been resolved: media: nxp: imx8-isi: Fix use-after-free on remove KASAN reports a slab-use-after-free in mediaentityremovelink during rmmod of imx8isi: BUG: KASAN: slab-use-after-free in mediaentityremovelink+0x608/0x650 Read of size 2 at addr...

EUVD-2026-48957

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

CVE-2026-64396

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...

EUVD-2026-48940

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix UAF of struct filelock in SMB2LOCK deferred-lock cancellation When a blocking byte-range lock request is deferred in the FILELOCKDEFERRED path, ksmbd registers the asynchronous work into the connection's asyncrequests...