CVE-2026-99067

The Linux kernel contains a vulnerability in the btrfs filesystem related to the scrub functionality. Specifically, the scrub_print_warning_inode() function fails to drop the reference taken by btrfs_get_fs_root() when paths_from_inode() fails, causing a reference leak to the root every time path...

CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

EUVD-2026-108733

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

EUVD-2026-108732

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99066

The Linux kernel contains a vulnerability in the CAN (Controller Area Network) subsystem related to how skb headers are initialized. Specifically, commit 9f10374bb024 removed necessary calls to skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() within init_can_sk...

CVE-2026-99065 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

EUVD-2026-108731

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99065 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99065

The Linux kernel is affected by a CPU hotplug race condition within the cgroup/cpuset subsystem, specifically in the guarantee_active_cpus() function. The issue arises during CPU offline operations because the cpu_active_mask is updated in sched_cpu_deactivate() before cpuset_handle_hotplug() can...

CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

EUVD-2026-108730

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99064

The Linux kernel contains a vulnerability in the CIPSO implementation where the cipso_v4_skbuff_delattr() function removes CIPSO bytes but fails to adjust the cached offsets for subsequent options. This discrepancy causes consumers like ip_forward_options() and __ip_options_echo() to access incor...

CVE-2026-99063 dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

EUVD-2026-108729

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99063

The Linux kernel contains a vulnerability in the dm ioctl handling where the get_result_buffer() function fails to verify the buffer size relative to the struct dm_ioctl trailing padding. This allows data_start to point seven bytes past the end of the buffer, leading to a slab-out-of-bounds read ...

CVE-2026-99063 dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...