CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-64183

The CVE-2026-64183 issue affects the Linux kernel EFI runtime, specifically PRM calls, which could NULL-deref if PRM accesses occur before the EFI workqueue is allocated. The root cause is early ACPI PRM access during init before efisubsys_init() runs and before the runtime workqueue exists. The ...

CVE-2026-64134

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus ioviter for silencing At transition to the ioviter for PCM data transfer, we blindly applied the ioviter setup also for silencing i.e. data = NULL, and it leads to a calculation of bogus ioviter...

CVE-2026-64134 ALSA: pcm: Don't setup bogus iov_iter for silencing

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Don't setup bogus ioviter for silencing At transition to the ioviter for PCM data transfer, we blindly applied the ioviter setup also for silencing i.e. data = NULL, and it leads to a calculation of bogus ioviter...

CVE-2026-64134

The CVE-2026-64134 entry concerns the Linux kernel ALSA PCM path. The vulnerability arises during transition to iov_iter for PCM data transfer, where iov_iter was also configured for silencing (data = NULL), leading to a bogus iov_iter calculation and a NULL dereference on some architectures, not...

CVE-2026-64128 Bluetooth: ISO: drop ISO_END frames received without prior ISO_START

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: drop ISOEND frames received without prior ISOSTART ISO data PDUs carry a packet-boundary flag indicating START, CONT, END or SINGLE. The ISOCONT branch of isorecv guards against a missing ISOSTART by checking...

CVE-2026-64099 drm/v3d: Fix use-after-free of CPU job query arrays on error path

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099 drm/v3d: Fix use-after-free of CPU job query arrays on error path

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64079 netfilter: x_tables: allocate hook ops while under mutex

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

EUVD-2026-45652

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

CVE-2026-64048

The CVE-2026-64048 issue is in the Linux kernel SMC-D client (net/smc). A remote peer can reply with CHID 0 to a SMC-Dv2 proposal, matching an empty ism_dev slot and causing ini->ism_selected to 0. This can lead to a NULL pointer dereference in smc_conn_create() when dereferencing ism_dev[0]-&...

CVE-2026-64048 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini-ismdev/ini-ismchid is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt populates V2 entries starting at index 1, so when no ...

CVE-2026-64028

In the Linux kernel, the following vulnerability has been resolved: tracing: Avoid NULL return from histfieldname on truncation histfieldname returns "" everywhere except the fully-qualified VARREF/EXPR case, where snprintf truncation returns NULL early and bypasses the bottom NULL-"" guard...

CVE-2026-64004

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2026-63973

In the Linux kernel, the following vulnerability has been resolved: net: mana: Add NULL guards in teardown path to prevent panic on attach failure When queue allocation fails partway through, the error cleanup frees and NULLs apc-txqp and apc-rxqs. Multiple teardown paths such as manaremove,...

EUVD-2026-45745

In the Linux kernel, the following vulnerability has been resolved: net: mana: Skip redundant detach on already-detached port When manaperportqueueresetworkhandler runs after a previous detach succeeded but attach failed, the port is left in a detached state with apc-txqp and apc-rxqs already...

CVE-2026-63945 Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

CVE-2026-63945

CVE-2026-63945 affects the Linux kernel Bluetooth ISO code. The vulnerability arises when iso_sock_clear_timer() reads iso_pi(sk)->conn twice without holding the socket lock, while iso_chan_del() may NULL the connection under lock_sock, creating a window where the reference can be dropped and ...