CVE-2026-97952

A vulnerability exists in the Linux kernel 's sunvdc driver where a failure during __vdc_tx_trigger() causes the driver to fail to unmap LDC cookies . Because the descriptor remains in a READY state and the prod pointer is not advanced, the mapping is never released, leading to a permanent leak o...

CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

EUVD-2026-86806

In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails sendrequest maps the request's pages into the LDC channel's map table ldcmapsg, fills in the descriptor and marks it VIODESCREADY before ringing the doorbell via...

EUVD-2026-86807

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953

A vulnerability exists in the Linux kernel 's stmmac driver related to the TX descriptor availability check for TSO traffic . The stmmac_tso_xmit() function incorrectly estimates the required free TX descriptors by assuming the payload is split into TSO_MAX_BUFF_SIZE chunks. This logic underestim...

CVE-2026-97951

The Linux kernel contains a vulnerability in the iSCSI target component where certain aborted WRITE_PENDING commands cause a hang. When a LUN_RESET aborts a WRITE command in the TRANSPORT_WRITE_PENDING state, the target core sets the CMD_T_ABORTED flag and waits for the frontend. If the initiator...

EUVD-2026-86805

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITEPENDING commands When a LUNRESET aborts a WRITE command that is in the TRANSPORTWRITEPENDING state, the target core sets CMDTABORTED and waits for the frontend to finish processing. ...

CVE-2026-97950

The Linux kernel contains a vulnerability in configfs where create_link() incorrectly relies on an item reference that pins the item but not its dentry. A race condition between a symlink creation and an rmdir of its target can cause configfs_remove_dir() to release the dentry via simple_rmdir() ...

CVE-2026-97949

The Linux kernel contains a vulnerability in configfs where configfs_rmdir() fails to unhash a dentry before dropping the item. This creates a race condition because configfs_get_config_item() relies on the hashed state as proof of a live item, but simple_rmdir() only unhashes the dentry via d_de...

EUVD-2026-86804

In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...

EUVD-2026-86803

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfsgetconfigitem treats a hashed dentry as proof that sd-selement is a live configitem. configfsrmdir breaks that: simplermdir leaves the dentry hashed, the last...

EUVD-2026-86802

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

EUVD-2026-86801

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97948

The Linux kernel contains a vulnerability in the powerpc/eeh driver where a recursive locking issue can cause the eehd to hang. The root cause is that the pci_rescan_remove_lock is held during eeh_handle_normal_event() and eeh_reset_device(), but the code path in eeh_rmv_device() failed to remove...

CVE-2026-97947

The Linux kernel contains a vulnerability in the x86/amd_node component where amd_smn_read() and amd_smn_write() functions could trigger a NULL pointer dereference . This occurs because these functions are exported around __amd_smn_rw(), making them accessible even if amd_smn_init() fails. In suc...

CVE-2026-97946

The Linux kernel contains a flaw in the x86/amd_node architecture involving incorrect PCI device reference counting within the amd_smn_init() function. The issue stems from a local "root" pointer used as a temporary variable during device searching, where refcounts related to search iterators wer...

EUVD-2026-86800

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

EUVD-2026-86799

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

CVE-2026-97945

The Linux kernel contains a vulnerability in x86 memory management where PMD-mapped Huge Transparent Pages (THP) can experience data loss. The root cause is that pmd_modify() incorrectly masks out the hardware dirty bit (_PAGE_DIRTY). This causes the kernel to lose the dirty state of a page when ...

EUVD-2026-86798

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...