CVE-2026-99039 memstick: core: wait for request completion before freeing card

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

EUVD-2026-108834

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99038 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

CVE-2026-99038

A vulnerability in the Linux kernel 's rtsx_usb_ms driver causes a system hang during device removal. The issue occurs because requests are silently dropped instead of being completed after the eject flag is set. Specifically, rtsx_usb_ms_request() skips scheduling work once ejected, and cancel_w...

CVE-2026-99038 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

EUVD-2026-108833

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

CVE-2026-99037

The Linux kernel 's dm-crypt component contains a vulnerability where pairing an AEAD cipher with the lmk IV mode (e.g., capi:gcm(aes)-lmk) via a capi: table line causes an oops upon loading. The root cause is that lmk sets tfms_count to 64, while crypt_alloc_tfms_aead only allocates one transfor...

EUVD-2026-108832

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...

CVE-2026-99037 dm-crypt: reject the lmk IV mode with AEAD ciphers

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...

CVE-2026-99037 dm-crypt: reject the lmk IV mode with AEAD ciphers

In the Linux kernel, the following vulnerability has been resolved: dm-crypt: reject the lmk IV mode with AEAD ciphers A "capi:" table line that pairs an AEAD cipher with the lmk IV mode, for example "capi:gcmaes-lmk" with the integrity:28:aead option, causes an oops when it is loaded. lmk sets...

CVE-2026-99036 dm: fix reading free memory in do_resume

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

CVE-2026-99036 dm: fix reading free memory in do_resume

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

CVE-2026-99036

A race condition in the Linux kernel allows for reading freed memory during the do_resume operation in the dm (Device Mapper) component. The issue occurs because dm_table_get_mode(new_map) is called without holding necessary locks, potentially allowing a concurrent ioctl to swap the table between...

EUVD-2026-108831

In the Linux kernel, the following vulnerability has been resolved: dm: fix reading free memory in doresume When doresume calls dmtablegetmodenewmap, the call is done without holding any locks it only holds a reference to the md. It may be possible that another concurrent ioctl on the same device...

CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99035 mmc: mtk-sd: Cancel request timeout work on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99035

The Linux kernel contains a vulnerability in the mmc: mtk-sd driver where a use-after-free access occurs during the unbind process. The root cause is that msdc_drv_remove() can return and free the managed mmc_host before a req_timeout callback finishes executing. The callback incorrectly continue...

EUVD-2026-108830

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99034

The Linux kernel contains a vulnerability in the sdhci-sprd driver where the sdhci_sprd_remove() function fails to perform necessary runtime PM cleanup . While sdhci_sprd_probe() enables runtime PM, the removal path directly disables clocks managed by runtime PM callbacks without proper cleanup. ...

CVE-2026-99034 mmc: sdhci-sprd: disable runtime PM on remove

In the Linux kernel, the following vulnerability has been resolved: mmc: sdhci-sprd: disable runtime PM on remove sdhcisprdprobe enables runtime PM, while sdhcisprdremove does not perform the corresponding runtime PM cleanup. The probe failure path disables runtime PM before disabling the clocks,...