CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

EUVD-2026-103762

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510

The Linux kernel contains a race condition in the drm/xe/vm component. In xe_vm_close_and_put(), xe_vm_pt_destroy() was incorrectly invoked before processing contested VMAs, destroying vm->pt_root while VMAs remained linked to buffer objects. If a concurrent thread evicts a shared buffer objec...

EUVD-2026-103750

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98508

The Linux kernel contains a vulnerability in the drm/virtio component where a NULL pointer dereference occurs during fence allocation failures. Specifically, the function virtio_gpu_fence_alloc() can return NULL under memory pressure, but the caller virtio_gpu_init_submit() fails to validate this...

EUVD-2026-103748

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98504

The Linux kernel contains a vulnerability where the dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without a prior check. This occurs when a bridge device (Type 1 header) lacks an allocated secondary bus, such as when bus numbers are unavail...

CVE-2026-98504 PCI: of_property: Omit bus properties without a subordinate bus

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

EUVD-2026-103744

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98477

The Linux kernel contains a vulnerability in the perf/core component where __perf_pmu_sched_task() incorrectly passes a NULL pmu_ctx to pmu->sched_task(). This occurs because perf_pmu_sched_task() returns early when cpuctx->task_ctx is set, making cpc->task_epc null. The issue results in...

CVE-2026-98477 perf/core: Fix NULL pmu_ctx passed to pmu->sched_task()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmuctx passed to pmu-schedtask perfpmuschedtask returns early when cpuctx-taskctx is set, and cpc-taskepc is only non-NULL while a task context is scheduled in on this CPU. perfpmuschedtask therefore always...

EUVD-2026-103717

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmuctx passed to pmu-schedtask perfpmuschedtask returns early when cpuctx-taskctx is set, and cpc-taskepc is only non-NULL while a task context is scheduled in on this CPU. perfpmuschedtask therefore always...

CVE-2026-98476 s390/cio: Fix NULL pointer dereference in ccw_device_get_util_str()

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

CVE-2026-98476

The Linux kernel contains a NULL pointer dereference vulnerability in the s390/cio component within the ccw_device_get_util_str() function. This occurs because a channel path registry entry associated with a CHPID may be removed while a subchannel's PMCW still references that CHPID, causing chpid...

EUVD-2026-103716

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

CVE-2026-98467

The Linux kernel contains a vulnerability in the KVM subsystem for arm64 architectures. A race condition occurs during the teardown of a nested guest, where the kvm->arch.mmu.pgt can be set to NULL concurrently with kvm_nested_s2_unmap() and kvm_nested_s2_wp() operations. Specifically, stage2_...

CVE-2026-98467 KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

EUVD-2026-103707

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...