CVE-2026-64038

In the Linux kernel, the following vulnerability has been resolved: hwmon: lm90 Stop work before releasing hwmon device Sashiko reports: In lm90probe, the devm action to cancel the alertwork and reportwork lm90restoreconf is registered in lm90initclient before devmhwmondeviceregisterwithinfo is...

CVE-2026-63913

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...

CVE-2026-63915

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

Interpretation Conflict

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Interpretation Conflict via literal backslash handling in parseWithStatus in index.js. An attacker can bypass host-based validation by supplying a URI such as...

CVE-2026-64183

The CVE-2026-64183 issue affects the Linux kernel EFI runtime, specifically PRM calls, which could NULL-deref if PRM accesses occur before the EFI workqueue is allocated. The root cause is early ACPI PRM access during init before efisubsys_init() runs and before the runtime workqueue exists. The ...

CVE-2026-64181 mm: fix __vm_normal_page() to handle missing support for pmd_special()/pud_special()

In the Linux kernel, the following vulnerability has been resolved: mm: fix vmnormalpage to handle missing support for pmdspecial/pudspecial On x86 32-bit with THP enabled, zaphugepmd is seen to generate a "WARNING: mm/memory.c:735 at vmnormalpage+0x6a/0x7d", from the VMWARNONONCEiszeropfnpfn ||...

CVE-2026-64179

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipcimeminit The memory allocated in ipcprotocolinit is not freed on the error paths that follow in ipcimeminit. Fix that by calling the corresponding release function ipcprotocoldein...

CVE-2026-64179

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipcimeminit The memory allocated in ipcprotocolinit is not freed on the error paths that follow in ipcimeminit. Fix that by calling the corresponding release function ipcprotocoldein...

CVE-2026-64178

The CVE-2026-64178 issue is in the Linux kernel Bluetooth BNEP implementation. A use-after-free can occur when reading dev->name during bnep_add_connection() because the underlying net_device may be freed concurrently by bnep_del_connection(). The root cause is that bnep_add_connection() did n...

CVE-2026-64176

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix driver-set TX rates on old devices On old devices such as 7265D, rates are still encoded in version 1 format, which doesn't use the CCK/OFDM rate index 0-3/0-7 but rather their PLCP value e.g. 10 for 1 Mbp...

CVE-2026-64174 wifi: cfg80211: advance loop vars in cfg80211_merge_profile()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: advance loop vars in cfg80211mergeprofile cfg80211mergeprofile reassembles a Multi-BSSID non-transmitted BSS profile that has been split across multiple consecutive MBSSID elements. Its while-loop calls...

EUVD-2026-45845

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential for tearing in -remoteisize and -zeropoint Fix potential tearing in using -remoteisize and -zeropoint by copying isizeread and isizewrite and using the same seqcount as for isize. We need to make sure that...

CVE-2026-64155

CVE-2026-64155 is a memory leak in the ath11k WiFi driver in the Linux kernel. Two error paths in WMI WOW (Wake-on-Wireless) calls directly returned the result of ath11k_wmi_cmd_send() without checking the return value, causing the skb to not be freed on error. This results in a high availability...

CVE-2026-64155 wifi: ath11k: fix error path leaks in some WMI WOW calls

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix error path leaks in some WMI WOW calls Fix two instances where we used to directly return the result of ath11kwmicmdsend.... Because we did not check the return value, we also did not free the skb in the error...

CVE-2026-64153 drm/msm: Fix iommu_map_sgtable() return value check and avoid WARN

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix iommumapsgtable return value check and avoid WARN Commit "iommu: return full error code from iommumapsgatomic" changed iommumapsgtable to return an ssizet and negative values in error cases, rather than a sizet and a...

CVE-2026-64147 pds_core: fix debugfs_lookup dentry leak and error handling

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...

CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...

CVE-2026-64148

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...

CVE-2026-64147

The pds_core kernel driver leaks a dentry reference (missing dput()) on every firmware reset recovery, and when CONFIG_DEBUG_FS is disabled, debugfs_lookup() returns ERR_PTR(-ENODEV) rather than NULL, which the existing check passes, causing a crash. Red Hat confirms this can lead to denial of se...

EUVD-2026-45833

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix error handling in pdscdevcmdwait Fix two cases where pdscdevcmdwait returns stale success from the completion register instead of an error: 1. FW crash: If firmware stops running, the wait loop breaks early with...