CVE-2026-64431 ntfs: avoid calling post_write_mst_fixup() for invalid index_block

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

CVE-2026-64432 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding th...

CVE-2026-64430

CVE-2026-64430 affects the Linux kernel NTB EPF subsystem. ntb_epf_vec_isr previously called pci_irq_vector() in hardirq context, and pci_irq_vector() may call msi_get_virq() which takes a mutex and can trigger scheduling while atomic. The fix caches the Linux IRQ number for vector 0 when vectors...

CVE-2026-64430 NTB: epf: Avoid calling pci_irq_vector() from hardirq context

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pciirqvector from hardirq context ntbepfvecisr calls pciirqvector in hardirq context to derive the vector number. pciirqvector calls msigetvirq that takes a mutex and can therefore trigger "scheduling whil...

EUVD-2026-48774

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pciirqvector from hardirq context ntbepfvecisr calls pciirqvector in hardirq context to derive the vector number. pciirqvector calls msigetvirq that takes a mutex and can therefore trigger "scheduling whil...

CVE-2026-64429

CVE-2026-64429 : In the Linux kernel, the gpio eic-sprd driver used a sleeping lock during irq startup (spin_lock_irqsave) which could be invoked from an irq_startup path, leading to a sleeping function in an invalid context on PREEMPT_RT. The fix converts the Spreadtrum EIC controller lock to a ...

EUVD-2026-48773

In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use rawspinlockt in the irq startup path sprdeicirqunmask enables the GPIO IRQ and then updates controller state through sprdeicupdate, which takes sprdeic-lock with spinlockirqsave. The callback can be reached fr...

EUVD-2026-48772

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

CVE-2026-64428

In CVE-2026-64428, a Linux kernel vulnerability was fixed in the GPIO SCH irq path. The issue arose because sch_irq_unmask() enables the GPIO IRQ and then updates controller state via sch_irq_mask_unmask(), which uses sch->lock with spin_lock_irqsave(). The callback could reach irq_startup() w...

CVE-2026-64428 gpio: sch: use raw_spinlock_t in the irq startup path

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

CVE-2026-64428 gpio: sch: use raw_spinlock_t in the irq startup path

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

CVE-2026-64427

Consolidated data for CVE-2026-64427 shows a resolved Linux kernel HID issue in the Logitech DJ driver. Root cause: the DJ short report validation could dereference rep->field[0] when rep->maxfield was zero, even after a prior fix, due to a crafted descriptor that creates a 0x20 report with...

EUVD-2026-48771

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64426

Summary (CVE-2026-64426) Multiple sources describe a Linux kernel vulnerability in io_uring/nop where a file reference leak occurs when IOSQE_FIXED_FILE is set but IORING_NOP_FIXED_FILE is not; if REQ_F_FIXED_FILE is set, io_nop() may take the normal path and grab a real reference via io_file_get...

EUVD-2026-48769

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64425

CVE-2026-64425 affects the Linux kernel io_uring/io-wq component. The vulnerability arises from where io_worker_handle_work() snapshots IO_WQ_BIT_EXIT and only later re-checks it inside the outer work loop, allowing linked work items to run after exit has begun if IO_WQ_BIT_EXIT is set post-start...

EUVD-2026-48967

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...

CVE-2026-64422 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp-reordering field for new...