CVE-2026-68177 tracing: Delay module ref count for "enable_event" trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

EUVD-2026-55278

In the Linux kernel, the following vulnerability has been resolved: tracing: Delay module ref count for "enableevent" trigger Triggers are now delayed from freeing, but can still be triggered until after the RCU grace period has ended. The freeing of the enableevent data is put into the...

CVE-2026-68177

The CVE-2026-68177 entry describes a Linux kernel tracing vulnerability in which delaying the release of a module that contains an active enable/disable event leads to use-after-free if the module is removed while still referenced by an event. The underlying issue is that the module refcount is r...

CVE-2026-68176

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

CVE-2026-68176 tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix mmiotrace possible NULL dereferencing of hiter-dev If the mmiopipeopen fails to find a PCI device, the hiter-dev will be assigned to NULL. The mmiotrace read function dereferences the hiter-dev if hiter exists. Chang...

EUVD-2026-55276

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

CVE-2026-68175

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix resource leak on mmiotrace tracepipe close The mmiotrace tracer was added May 12th 2008. At that time, resources created in pipeopen could not be freed because there was not pipeclose function pointer of the tracer...

CVE-2026-68175

The CVE-2026-68175 entry documents a fixed resource leak in the Linux kernel tracing subsystem (mmiotrace) related to trace_pipe close. Specifically, mmio_pipe_open() allocated a header_iter and took a pci_dev reference when trace_pipe opened; mmio_close() frees them but was not wired to the trac...

CVE-2026-68174

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68174

The vulnerability CVE-2026-68174 affects the Linux kernel tracing subsystem. In struct trace_event_call, the module pointer and the refcnt atomic share a union, so for dynamic events (kprobe, uprobe, fprobe, eprobe, wprobe) the refcnt may be non-zero and cause call->module to appear as a small...

CVE-2026-68174 tracing: Fix union collision of module and refcnt for dynamic events

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68174 tracing: Fix union collision of module and refcnt for dynamic events

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

EUVD-2026-55274

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173 ublk: wait on ublk_dev_ready() instead of ub->completion

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173 ublk: wait on ublk_dev_ready() instead of ub->completion

In the Linux kernel, the following vulnerability has been resolved: ublk: wait on ublkdevready instead of ub-completion ub-completion is only re-armed by a successful STARTUSERRECOVERY. If the ublk server sends ENDUSERRECOVERY without one - e.g. its START failed with -EBUSY and the error was...

CVE-2026-68173

CVE-2026-68173 affects the Linux kernel ublk subsystem. The root cause is that ub->completion is an edge-triggered latch used as a proxy for the readiness condition; when a server sends END_USER_RECOVERY without a preceding START_USER_RECOVERY, the wait can be satisfied by a stale completion, ...

CVE-2026-68172

CVE-2026-68172 affects the arm64 Linux kernel where huge_ptep_get may mis-handle unaligned addresses across contpmd/contpte hugetlb foliοs. The arm64 helper may misclassify the target as CONT_PTES instead of CONT_PMDS, potentially causing excess A/D state handling, dereferencing a garbage ptep, o...

CVE-2026-68172

In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...

EUVD-2026-55558

In the Linux kernel, the following vulnerability has been resolved: arm64: make hugeptepget handled unaligned addresses hugeptepget can be handed a virtual address pointing to the middle of a contpmd/contpte mapped hugetlb folio examples of callers are pagemaphugetlbrange, pagemappedinvma. The...