CVE-2026-98529 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizonagpiodirectionout Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmapupdatebits fails the reference ...

CVE-2026-98529

The Linux kernel contains a runtime PM reference leak within the arizonas gpio driver. Specifically, when switching a persistent GPIO line from input to output, the system acquires a runtime PM reference on the parent device. If the subsequent regmap_update_bits() function fails, this reference i...

EUVD-2026-103574

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizonagpiodirectionout Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmapupdatebits fails the reference ...

CVE-2026-98528

The Linux kernel contains a vulnerability in the gpio cdev component where a failure to acquire the GPIO chip guard in gpio_desc_to_lineinfo() causes the function to return prematurely. This results in a kernel stack leak to user-space because the information structure is not zeroed before being ...

CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

EUVD-2026-103573

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98527

The Linux kernel contains a runtime power management (PM) leak within the zynq gpio driver. The issue occurs because pm_runtime_get_sync() increments a usage counter even on failure, while zynq_gpio_request() fails to drop the reference. Because gpiolib fails to call ->free() during a request ...

CVE-2026-98527 gpio: zynq: fix runtime PM leak on request error path

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

EUVD-2026-103572

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-98526

The Linux kernel contains a vulnerability in how the llc_alloc_frame() function reserves link-layer headroom. The current implementation uses the device type, which is insufficient for stacked Ethernet devices like VLAN devices . Because vlan_dev_hard_header() inserts a VLAN header before the low...

EUVD-2026-103571

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...

CVE-2026-98526 llc: reserve device headroom for allocated frames

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...

krie

KRIe KRIe is a research project that aims to detect Linux Kernel exploits with eBPF. KRIe is far from being a bulletproof strategy: from eBPF related limitations to post exploitation detections that might rely on a compromised kernel to emit security events, it is clear that a motivated attacker...

EUVD-2026-103570

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

CVE-2026-98525

The Linux kernel contains a vulnerability in the MCTP protocol within the mctp_lookup_prealloc_tag() function. When a socket transmits a packet with MCTP_TAG_PREALLOC set, the kernel incorrectly iterates over the per-network namespace keys list (&mns->keys) instead of the specific socket's tag...

CVE-2026-98525 mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

CVE-2026-98524

A use-after-free vulnerability exists in the Linux kernel 's RDMA shared memory (rds) infrastructure. The rds_ib_map_frmr() function incorrectly stores a caller's scatterlist in a memory region (MR) before DMA mapping/registration is confirmed. If these steps fail, rds_ib_free_frmr() may return t...

CVE-2026-98524 rds: ib: Clear the sg list when mapping an MR fails

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...

EUVD-2026-103569

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...

EUVD-2026-103763

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...