CVE-2026-99257

The Linux kernel contains a vulnerability where fwnode-based lookups for shared GPIOs without an associated struct device cause a NULL-pointer deference . This occurs because the platform lookup tables for shared GPIOs require a device structure to function. The issue has been addressed by adding...

CVE-2026-99258 x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

EUVD-2026-115768

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

CVE-2026-99259

In the Linux kernel , a vulnerability exists affecting legacy 32-bit Tegra devices within the PMC driver . The issue is caused by an uninitialised clock rate because the early_pmc->rate variable is never configured, remaining at 0. This occurred after the PMC driver was updated to create the P...

CVE-2026-99259 soc/tegra: pmc: Fix uninitialised clock rate

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegrapmcentersuspendmode function is being triggered because the earlypmc-rate variable is never configured and hence, always 0. Thi...

CVE-2026-99257 gpio: shared: gracefully handle no-device lookup of shared GPIOs

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: gracefully handle no-device lookup of shared GPIOs We use platform lookup tables for shared GPIOs. This mechanism needs a struct device to work so fwnode-based lookup with no device associated currently causes a...

EUVD-2026-115769

In the Linux kernel, the following vulnerability has been resolved: x86/hyperv: Avoid using per-cpu output page in hvapicidtovpindex hvapicidtovpindex currently uses the per-cpu hypercall input and output pages. This function is called when running in VTL2 and when running in an SEV-SNP CoCo VM...

EUVD-2026-115770

In the Linux kernel, the following vulnerability has been resolved: soc/tegra: pmc: Fix uninitialised clock rate For legacy 32-bit Tegra devices, the warning in the tegrapmcentersuspendmode function is being triggered because the earlypmc-rate variable is never configured and hence, always 0. Thi...

CVE-2026-99258

The Linux kernel contains a vulnerability in the x86/hyperv architecture specifically regarding the hv_apicid_to_vp_index() function. The issue arises because the function uses per-cpu hypercall input and output pages; however, in SEV-SNP CoCo VMs without a paravisor, the output page is not alloc...

CVE-2026-99256 dm cache: fix issue with background work locking

In the Linux kernel, the following vulnerability has been resolved: dm cache: fix issue with background work locking dm cache used a rwsemaphore for backgroundworklock. Write locks on rwsemaphores have strict owner semantics, but there was no guarantee that the process that locked...

CVE-2026-99255 io_uring/io-wq: don't hide a link from cancellations

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks everywhere a request can be, and goes to sleep if it found nothing to...

EUVD-2026-115766

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks everywhere a request can be, and goes to sleep if it found nothing to...

CVE-2026-99255 io_uring/io-wq: don't hide a link from cancellations

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: don't hide a link from cancellations A task that exits cancels its tracked requests and waits until they are gone. iouringcancelgeneric looks everywhere a request can be, and goes to sleep if it found nothing to...

CVE-2026-99255

A vulnerability exists in the Linux kernel within the io_uring/io-wq subsystem where an exiting task can enter an unkillable sleep state. The issue occurs because there is a race condition during the processing of linked requests: a request can be removed from its link but not yet assigned to a w...

EUVD-2026-115763

In the Linux kernel, the following vulnerability has been resolved: iouring/mpscq: disable preemption while pushing A push makes the node the new tail, and then links it to its predecessor. In between the queue isn't empty, but mpscqpop can't get at the node. The consumers deal with that by tryin...

CVE-2026-99253 io_uring/cancel: rearm local work wake up before sleep

In the Linux kernel, the following vulnerability has been resolved: iouring/cancel: rearm local work wake up before sleep iouringtrycancelrequests sets -cqwaitnr to 1 so that the next ioreqlocalworkadd wakes the cancelling task. The add that takes the count to zero is the only one that wakes, lat...

CVE-2026-99254 io_uring: don't flood a cancelling task with task_work

In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb doesn't touch the node while...

CVE-2026-99252

The Linux kernel contains a vulnerability in the io_uring/mpscq component where a producer task can be preempted between making a node the new tail and linking it to its predecessor. If a high-priority consumer (e.g., SCHED_FIFO ) runs on the same CPU as a lower-priority producer (e.g., SCHED_OTH...

CVE-2026-99254 io_uring: don't flood a cancelling task with task_work

In the Linux kernel, the following vulnerability has been resolved: iouring: don't flood a cancelling task with taskwork ioringexitwork asks each task which has used the ring to remove its tctx node, by taskwork, and repeats that until the list is empty. iotctxexitcb doesn't touch the node while...

CVE-2026-99253

The Linux kernel is affected by a vulnerability in the io_uring subsystem where a task can become stuck in execve() or fail to resume because it is woken up before it sleeps. The issue occurs in io_uring_try_cancel_requests() when it sets ->cq_wait_nr to 1; if a work item is added and processe...