EUVD-2026-108734

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

CVE-2026-99067

The Linux kernel contains a vulnerability in the btrfs filesystem related to the scrub functionality. Specifically, the scrub_print_warning_inode() function fails to drop the reference taken by btrfs_get_fs_root() when paths_from_inode() fails, causing a reference leak to the root every time path...

CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

EUVD-2026-108733

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-99066

The Linux kernel contains a vulnerability in the CAN (Controller Area Network) subsystem related to how skb headers are initialized. Specifically, commit 9f10374bb024 removed necessary calls to skb_reset_mac_header(), skb_reset_network_header(), and skb_reset_transport_header() within init_can_sk...

EUVD-2026-108732

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99066 can: dev: init_can_skb(): restore skb header initialization

In the Linux kernel, the following vulnerability has been resolved: can: dev: initcanskb: restore skb header initialization Commit 9f10374bb024 "can: remove private CAN skb headroom infrastructure" removed the skbresetmacheader/skbresetnetworkheader/ skbresettransportheader calls from initcanskb...

CVE-2026-99065

The Linux kernel is affected by a CPU hotplug race condition within the cgroup/cpuset subsystem, specifically in the guarantee_active_cpus() function. The issue arises during CPU offline operations because the cpu_active_mask is updated in sched_cpu_deactivate() before cpuset_handle_hotplug() can...

CVE-2026-99065 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99065 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

EUVD-2026-108731

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

EUVD-2026-108730

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99064

The Linux kernel contains a vulnerability in the CIPSO implementation where the cipso_v4_skbuff_delattr() function removes CIPSO bytes but fails to adjust the cached offsets for subsequent options. This discrepancy causes consumers like ip_forward_options() and __ip_options_echo() to access incor...

CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99063

The Linux kernel contains a vulnerability in the dm ioctl handling where the get_result_buffer() function fails to verify the buffer size relative to the struct dm_ioctl trailing padding. This allows data_start to point seven bytes past the end of the buffer, leading to a slab-out-of-bounds read ...