CVE-2026-93059

CVE-2026-93059 affects the drm/msm driver in the Linux kernel . The root cause is a missing put_task_struct() call in the else branch of recover_worker, while get_pid_task() had already incremented the task reference count. This results in a task_struct reference leak on every GPU hang recovery ,...

EUVD-2026-82169

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

CVE-2026-90434 isofs: release zisofs block pointer buffer head

In the Linux kernel, the following vulnerability has been resolved: isofs: release zisofs block pointer buffer head zisofsfillpages reads the compressed block pointer table. The error paths release the current bufferhead, the loop also releases the old bufferhead when it advances. However, the...

CVE-2026-90396 block: fix dio leak on metadata mapping error

In the Linux kernel, the following vulnerability has been resolved: block: fix dio leak on metadata mapping error A failed integrity mapping holds a dio reference, so we need to go through the full bio ending in case there were previously submitted bio's in the sequence...

CVE-2026-90396

CVE-2026-90396 affects the Linux kernel block subsystem. When an integrity mapping fails, it holds a DIO (direct I/O) reference that is not properly released. The fix ensures the full bio ending path is taken, which properly handles previously submitted bios in the sequence and releases the leake...

CVE-2026-90354 wifi: mt76: mt7915: fix double hif2 init on the non-WED path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

CVE-2026-90354 wifi: mt76: mt7915: fix double hif2 init on the non-WED path

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

EUVD-2026-82015

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: fix double hif2 init on the non-WED path mt7915pciinithif2 was called unconditionally and again inside the WED-inactive branch. The helper increments the global hifidx, writes the PCIe RECOGID register and tak...

CVE-2026-90352

CVE-2026-90352 affects the mt76: mt7915 WiFi driver in the Linux kernel . The root cause is a resource leak : the hif2 reference obtained by mt7915_pci_init_hif2() is only released on error paths that key off dev->hif2, which is not assigned until after IRQ setup. If pci_alloc_irq_vectors() or...

CVE-2026-90352 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

EUVD-2026-82013

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

CVE-2026-90352 wifi: mt76: mt7915: release hif2 reference on probe IRQ failure

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: release hif2 reference on probe IRQ failure The hif2 reference obtained by mt7915pciinithif2 is only released on error paths that key off dev-hif2, which is not assigned until after the IRQ setup. If...

CVE-2026-90298 drm/sun4i: tcon: Drop TCON TOP device reference

In the Linux kernel, the following vulnerability has been resolved: drm/sun4i: tcon: Drop TCON TOP device reference offinddevicebynode takes a device reference. Drop it after mux configuration succeeds...

CVE-2026-90298

CVE-2026-90298 affects the Linux kernel Allwinner DRM (drm/sun4i) TCON driver . The root cause is a device reference leak : the function of_find_device_by_node() acquires a device reference, which was not dropped after mux configuration succeeds. The fix, provided in the referenced kernel commits...

EUVD-2026-81866

In the Linux kernel, the following vulnerability has been resolved: coresight: etm4x: missing cscfgcsdevdisableactiveconfig in perf enable In the perf enable path, there are missing cases where cscfgcsdevdisableactiveconfig is not called: - Branch broadcast is selected but not supported by the...

EUVD-2026-81835

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix iopfrefcount leak on RID domain replacement inteliommuattachdevice enables IOPF for the new domain but never disables it for the old one. deviceblocktranslation, called at the start of the function, tears down...

CVE-2026-90236 NFSD: Release the export reference when reaping open stateids

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

CVE-2026-90236

CVE-2026-90236 affects the Linux kernel NFSD (NFS server daemon). The bug is a reference-counting flaw in NFSv4 state ID teardown: free_ol_stateid_reaplist() frees open and lock stateids via ->sc_free() without releasing the svc_export reference, unlike nfs4_put_stid(). This pins the export an...

CVE-2026-90236 NFSD: Release the export reference when reaping open stateids

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...

EUVD-2026-81829

In the Linux kernel, the following vulnerability has been resolved: NFSD: Release the export reference when reaping open stateids nfs4putstid releases the svcexport tracked in nfs4stid.scexport, but freeolstateidreaplist frees open and lock stateids by calling -scfree directly, bypassing that pat...