CVE-2026-98268

The Linux kernel contains a vulnerability where a null pointer dereference occurs within the perf subsystem. Specifically, a module unload event with an active perf connection causes __pmu_detach_event() to set event->pmu to null. When the connection is subsequently closed, _free_event() calls...

EUVD-2026-93196

In the Linux kernel, the following vulnerability has been resolved: perf: Fix null pointer access in isincludeguestevent A typical module unload occurring event when there is an active perf connection leads to freeing of the pmu pointer. The call log is something like: .. pmudetachevent...

EUVD-2026-93195

In the Linux kernel, the following vulnerability has been resolved: 9p: Fix v9fsissuewrite to update isize and remoteisize Fix v9fsissuewrite to update isize and remoteisize to the new size of the server file if we made it larger, using the start fpos and the count returned by p9clientwrite to...

CVE-2026-98266

The Linux kernel contains a use-after-free vulnerability in the ALSA core component. The issue occurs when a sound card is released asynchronously via snd_card_free_when_closed(), such as in USB-audio drivers . While snd_card_disconnect() gates new accesses, in-flight tasks may still access the u...

EUVD-2026-93194

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix potential UAF after asynchronous card release Usually a sound driver releases the resources assigned to the card via sndcardfree, and it synchronizes with the whole release procedure. However, when the card is...

CVE-2026-98265

The Linux kernel contains a vulnerability in the ALSA usb-audio driver where the data_ep_set_params() function allocates data URB memory based on u->packets. However, for implicit feedback sinks, snd_usb_queue_pending_output_urbs() may overwrite this limit with a larger count from the sync sou...

EUVD-2026-93193

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...

CVE-2026-98264

The Linux kernel contains a vulnerability in the ALSA virtio driver where virtsnd_remove() and virtsnd_freeze() delete virtqueues before resetting the device. Because del_vqs() frees the vring backing without a generic device quiesce operation, modern virtio-pci may keep enabled queues active, po...

EUVD-2026-93192

In the Linux kernel, the following vulnerability has been resolved: ALSA: virtio: reset device before deleting virtqueues virtsndremove and virtsndfreeze delete the virtqueues before resetting the device. delvqs frees the vring backing, but does not provide a generic device quiesce operation. In...

EUVD-2026-93190

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as so...

CVE-2026-98262

The Linux kernel libahci driver contains a functional issue where the JMicron JMB585 becomes unusable when the AHCI_HFLAG_32BIT_ONLY flag is used. The root cause is that for HBAs supporting 64-bit addressing, the PxCLBU and PxFBU registers have implementation-specific reset values; however, when ...

EUVD-2026-93191

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98263

The Linux kernel contains a vulnerability in the ASoC: codecs: rt712-sdca-dmic component. The root cause is that the stream_config structure is not initialized before being passed to sdw_stream_add_slave() , allowing the type field to contain garbage values. This uninitialized data is subsequentl...

CVE-2026-98261

The Linux kernel contains a use-after-free vulnerability within the cifs component, specifically in the cifs_chan_skip_or_disable() function. The issue occurs when a secondary channel is no longer supported by the server; the function drops the channel reference via cifs_put_tcp_session() but con...

EUVD-2026-93189

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifschanskipordisable When a secondary channel is no longer supported by the server, cifschanskipordisable drops the channel reference with cifsputtcpsession and then continues to use the server...

CVE-2026-98260

The Linux kernel is vulnerable to a use-after-free condition during the execve() system call. When a non-leader thread executes, de_thread() reassigns the PID to a leader thread, but the per-thread CPU timer node remains queued on the original thread. If subsequent operations like exec_mmap() fai...

CVE-2026-98259

The Linux kernel is vulnerable to a kernel panic when booting a VM with DAX enabled storage . The issue is caused by calling dax_to_folio() with an empty entry , which occurs in the fs/dax component. Specifically, the vulnerability persists in dax_associate_entry(), dax_disassociate_entry(), and ...

EUVD-2026-93187

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

EUVD-2026-93188

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98258

The Linux kernel contains a race condition in the posix-cpu-timers code. The issue stems from the cpu_timer::firing bit being converted to a boolean, which fails to distinguish between a timer not being owned by the firing list and one whose delivery was canceled. This allows a race between the e...