CVE-2026-53365

CVE-2026-53365 — VsockDrop:iouring + AFVSOCK Zero-Copy Reference Count Underflow, Page-Cache Overwrite Privilege Escalation HackSpeak distribution mirror. This repository is a distribution mirror of MaherAzzouzi/vsockdrop , with code identical to upstream; upstream does not include a LICENSE, so...

CVE-2026-97504

The Linux kernel contains a vulnerability in the lenovo_se10_wdt watchdog driver. The issue involves a use-after-free risk and a potential resource leak where the se10_pdev pointer was not properly handled. To address this, the driver was updated to set se10_pdev to null to prevent use-after-free...

EUVD-2026-86102

In the Linux kernel, the following vulnerability has been resolved: watchdog: lenovose10wdt: Fix use-after-free and resource leak risk Review by sashiko.dev highlighted potential use after free and resource leak instances. Set se10pdev to null to prevent use after free Remove DMI call back and...

CVE-2026-97503

The Linux kernel contains a vulnerability where the /proc/irq// directory names are built using a char name[10] buffer with sprintf(name, "%u", irq). Because sparse-IRQ configurations allow interrupt numbers in the ten-digit range, these numbers require 11 bytes including the trailing NUL, leadin...

EUVD-2026-86101

In the Linux kernel, the following vulnerability has been resolved: genirq/proc: Size interrupt directory names for 10-digit interrupt numbers /proc/irq// directory names are built in char name10 buffers with sprintfname, "%u", irq. Ten-digit IRQ numbers already need 11 bytes including the traili...

EUVD-2026-86100

In the Linux kernel, the following vulnerability has been resolved: mmc: davinci: avoid NULL deref of host-data in IRQ handler mmcdavinciirq returns early only when both host-cmd and host-data are NULL: if host-cmd == NULL && host-data == NULL ... return IRQNONE; So we may legitimately reach the...

CVE-2026-97502

The Linux kernel contains a vulnerability in the mmc_davinci_irq() function within the davinci host controller driver. The root cause is a NULL pointer dereference occurring when host->data is NULL, but specific status bits (such as TOUTRD , CRCWR , or CRCRD ) are set in qstatus. Specifically,...

EUVD-2026-86099

In the Linux kernel, the following vulnerability has been resolved: pinctrl: mediatek: paris: bypass pinctrl GPIO layer in set GPIO direction pinctrlgpiodirectioninput / pinctrlgpiodirectionoutput take the pinctrl mutex. This causes a gpiochip operations to need to sleep. Worse yet, the .cansleep...

CVE-2026-97501

The Linux kernel contains a vulnerability in the Mediatek pinctrl driver where pinctrl_gpio_direction_input() and pinctrl_gpio_direction_output() functions take a pinctrl mutex . This causes gpiochip operations to need to sleep, but because the .can_sleep field is not set, the shared GPIO proxy i...

EUVD-2026-86098

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

CVE-2026-97500

The Linux kernel contains a vulnerability in the rtw89 wifi driver. The phy component fails to validate the length of the PHY status IE reported by hardware before parsing, which could allow the parser to access out of range memory. The issue has been resolved in the kernel via commits providing ...

EUVD-2026-86097

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

CVE-2026-97499

The Linux kernel contains a vulnerability in the coresight: perf component. The issue arises because ETM perf callbacks currently use the per-CPU csdev_src pointer , which is susceptible to a race condition during device registration and unregistration. To resolve this, the fix utilizes the path ...

CVE-2026-97498

The Linux kernel contains a vulnerability in the drm/amdgpu/userq component where mqd and fw objects (queue core objects) were not properly pinned to avoid eviction. If these buffers were evicted while the hardware continued to use the invalid addresses, it resulted in page faults and system hang...

EUVD-2026-86096

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers...

EUVD-2026-86095

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

CVE-2026-97497

The Linux kernel contains a vulnerability in the drm/amdkfd component. The allocate_sdma_queue function fails to perform bounds-checking on the sdma queue id value, which is used by CRIU . This could allow an out-of-bounds access if the specified ID exceeds the maximum number of queues. Remediati...

EUVD-2026-86094

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

CVE-2026-97496

The Linux kernel contains an Out-of-Bounds (OOB) memory exposure vulnerability in the drm/amdkfd driver within the get_wave_state() function. The issue stems from the function trusting cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read from the MQD , which are attacker-controlled via...

EUVD-2026-86093

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...