DEBIAN-CVE-2026-89440

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If mmcaddhost fails, the error path only unmaps the registers and...

DEBIAN-CVE-2026-81015

In the Linux kernel, the following vulnerability has been resolved: platform/x86/amd/pmc: Fix LPS0 and debugfs leaks when STB init fails amdpmcprobe registers the LPS0 s2idle handler with acpiregisterlps0dev and creates the driver's debugfs directory before calling amdstbs2dinit, which is the las...

CVE-2026-80953

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

UBUNTU-CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89440

In the Linux kernel, the following vulnerability has been resolved: mmc: via-sdmmc: stop card-detect handling on probe failure requestirq registers the SD card-detect interrupt and the probe enables it before mmcaddhost runs. If mmcaddhost fails, the error path only unmaps the registers and...

CVE-2026-80953

In the Linux kernel, the following vulnerability has been resolved: i3c: master: adi: initialize the lock before enabling interrupts adii3cmasterprobe requests the IRQ and unmasks REGIRQPENDINGCMDR before the controller's IBI state, transfer queue list and transfer queue lock are initialized. A...

CVE-2026-80950

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

CVE-2026-80950

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

UBUNTU-CVE-2026-80950

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

DEBIAN-CVE-2026-80950

In the Linux kernel, the following vulnerability has been resolved: i3c: renesas: Check that the transfer is valid before accessing it The Renesas I3C driver uses an asynchronous model to transfer data. It prepares a struct renesasi3cxfer, enqueues it, and waits for completion. The interrupt...

UBUNTU-CVE-2026-89622

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

UBUNTU-CVE-2026-89508

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

UBUNTU-CVE-2026-80973

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: bound the MIDI event length from the device usb6firecommreceiverhandler forwards a MIDI event using a length byte the device supplies, with no bound and no check that the transfer delivered that many bytes: if...

UBUNTU-CVE-2026-89475

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq24257: fix use-after-free on remove The STAT-pin interrupt is devm-managed, so it stays armed until the devm cleanup that runs after remove returns. remove cancels bq-iilimitsetupwork while the threaded handler c...

CVE-2026-89570

In the Linux kernel, the following vulnerability has been resolved: cxl/mce: Make the MCE notifier per-region Flavien Solt reported lifetime issues with the CXL MCE notifier, which can lead to NULL dereferences and use-after-free in the MCE handler. The notifier was registered per memory device a...

CVE-2026-89469

In the Linux kernel, the following vulnerability has been resolved: power: supply: lp8727: fix use-after-free in lp8727releaseirq lp8727isrfunc, the threaded IRQ handler, is the only caller that arms pchg-work via scheduledelayedwork. lp8727releaseirq currently cancels the work before freeing the...

EUVD-2026-76534

In the Linux kernel, the following vulnerability has been resolved: HID: mcp2221: clear rxbuf after I2C/SMBus transfer completes mcpi2csmbusread stores the caller-supplied buffer pointer in mcp-rxbuf for the duration of a transfer but never clears it when the transfer finishes or times out. Once...

EUVD-2026-76437

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Reject connection when transport allocation fails handleconnectreq returns without action when svcrdmacreatexprt fails to allocate the new transport. The CM core returns 0 for CONNECTREQUEST events, so it does not destro...

CVE-2026-89508 RDMA/ucma: Lock the handler in ucma_set_ib_path()

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...

EUVD-2026-76414

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Lock the handler in ucmasetibpath ucmasetibpath calls ucmaeventhandler straight from the write path, without the handler lock that keeps ctx-file stable while a uevent is queued. The handler re-reads ctx-file for every...