EUVD-2026-108793

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

CVE-2026-98999

The Linux kernel contains a vulnerability in the drm/xe driver where a buffer object (bo ) can remain linked in the xe->pinned.late.external list indefinitely. This occurs when a bo is pinned both externally (e.g., dma-buf export) and as a framebuffer (fb ); if the external unpin occurs first,...

CVE-2026-98998 drm/bridge: th1520-dw-hdmi: Fix remove() callback

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98998

The Linux kernel contains a vulnerability in the drm/bridge: th1520-dw-hdmi driver. The issue stems from a type mismatch during the removal process: the driver stores a struct th1520_hdmi * in the platform drvdata, but the th1520_dw_hdmi_remove() function incorrectly reads it back as struct dw_hd...

EUVD-2026-108792

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98998 drm/bridge: th1520-dw-hdmi: Fix remove() callback

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

CVE-2026-98997 drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

EUVD-2026-108791

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

CVE-2026-98997

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

CVE-2026-98997

The Linux kernel contains a vulnerability within the amdgpu driver's userq component. The function amdgpu_userq_get_doorbell_index() incorrectly pins any Buffer Object (BO) passed as a doorbell_handle into the doorbell domain. For standard BOs, the TTM subsystem moves them using ttm_bo_move_null(...

CVE-2026-98997 drm/amdgpu/userq: only accept doorbell BOs as queue doorbell

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: only accept doorbell BOs as queue doorbell amdgpuuserqgetdoorbellindex pins any BO passed as doorbellhandle into the doorbell domain. For a regular BO, TTM moves it with ttmbomovenull and its contents are lost...

CVE-2026-98996

The Linux kernel contains a vulnerability in the propagate_mount_busy() helper function, which fails to correctly identify busy mounts during synchronous unmounting. Due to a logic mismatch with the propagate_umount() function, the kernel may skip reference checks on mount copies that have two or...

CVE-2026-98996 fs: don't silently unmount busy mounts

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98996

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98996 fs: don't silently unmount busy mounts

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

EUVD-2026-108790

In the Linux kernel, the following vulnerability has been resolved: fs: don't silently unmount busy mounts The propagatemountbusy helper exists to decide whether a synchronous can suceed. It does that by looking at the copies of the victims in the mounts its parent propagates to. One of those...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

EUVD-2026-108789

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98995

The Linux kernel contains a vulnerability in mnt_change_mountpoint() where it fails to reset the ->overmount pointer of an old parent during a mount move, unlike __umount_mnt(). This discrepancy can occur during a reparent() operation where propagate_umount() moves a surviving overmount. If a ...