EUVD-2026-86923

In the Linux kernel, the following vulnerability has been resolved: ASoC: fslmicfil: balance mclk enable/disable hwparams enables mclk unconditionally and hwfree disables it unconditionally, but the PCM core does not guarantee 1:1 pairing: hwfree can run without hwparams, and hwparams can be call...

CVE-2026-98094 staging: fbtft: make dirty_lock IRQ-safe

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...

EUVD-2026-86924

In the Linux kernel, the following vulnerability has been resolved: staging: fbtft: make dirtylock IRQ-safe fbtftmkdirty can be reached from the fbcon rendering path while processing printk in hardirq context. Meanwhile, dirtylock is also taken by fbtftdeferredio in workqueue context with local...

CVE-2026-98092

The Linux kernel contains a memory leak vulnerability within the ASoC: amd: yc driver. Specifically, the function acp6x_pdm_dma_close() fails to free the runtime->private_data buffer that is initially allocated during acp6x_pdm_dma_open(). This issue is addressed by adding the missing kfree op...

EUVD-2026-86922

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6xpdmdmaclose acp6xpdmdmaclose does not free the runtime-privatedata buffer allocated in acp6xpdmdmaopen. Add the missing kfree...

EUVD-2026-86921

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, createchunk adds the new device to the transaction devupdatelist through device-postcommitlist. If th...

CVE-2026-98091

The Linux kernel contains a vulnerability in btrfs where a failed sprout filesystem setup leads to a use-after-free condition. Specifically, when create_chunk() adds a new device to the dev_update_list via device->post_commit_list, a subsequent failure in system chunk creation causes btrfs_ini...

CVE-2026-98091 btrfs: detach failed sprout device from transaction update list

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, createchunk adds the new device to the transaction devupdatelist through device-postcommitlist. If th...

CVE-2026-98090 btrfs: restore active device pointers after failed sprout

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

CVE-2026-98090 btrfs: restore active device pointers after failed sprout

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

EUVD-2026-86920

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

CVE-2026-98090

The Linux kernel contains a vulnerability in the btrfs filesystem where btrfs_init_new_device() switches the latest_dev and s_bdev pointers from a seed device to a new sprout device. If chunk creation or sprout setup fails, the error path releases the new device without restoring these pointers. ...

CVE-2026-98088

The Linux kernel contains an out-of-bounds array read vulnerability within the scsi: mpt3sas driver. The issue occurs in the _base_assign_reply_queues() function because dev_to_node() can return NUMA_NO_NODE (-1) on systems lacking NUMA topology information (e.g., certain single-socket boards). T...

EUVD-2026-86918

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

EUVD-2026-86919

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

CVE-2026-98089

The Linux kernel contains a vulnerability in the bonding driver's alb component. Specifically, the function alb_determine_nd() incorrectly uses icmp6_hdr(skb) to inspect ICMPv6 headers. In certain xmit paths, such as those using AF_PACKET or raw sockets , the skb->transport_header is not guara...

EUVD-2026-86916

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98087

The Linux kernel contains a vulnerability where the RT balancer enters a retry loop when handling migrate_disable() 'd Real-Time (RT) tasks. Because these tasks remain on the pushable list while being pinned, the scheduler repeatedly attempts to push them, fails, and falls back to pushing the cur...

CVE-2026-98086

The Linux kernel contains a vulnerability in the ALSA subsystem related to the UMP component. The function snd_ump_parse_endpoint() incorrectly sets ump->parsed on every exit, including errors, before the legacy rawmidi device is attached. Consequently, ump_handle_ep_name_msg() may treat parse...

EUVD-2026-86917

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...