EUVD-2026-76557

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails,...

EUVD-2026-76558

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89646 ceph: fix leaked inode reference on writeback abort at umount

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89645

CVE-2026-89645 affects the btrfs filesystem in the Linux kernel. During relocation recovery , if loading a later root fails or the first transaction commit fails, btrfs_recover_relocation() exits via put_reloc_control(), which drops list-owned relocation root references but does not clear fs_root...

CVE-2026-89646

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount cephdirtyfolio takes a wrbuffer claim on each newly dirtied folio: it bumps iwrbufferref taking an ihold on the 0-1 transition and attaches the snapcontext to...

CVE-2026-89645 btrfs: drop recovered reloc root refs on recovery failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails,...

EUVD-2026-76502

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590 accel/rocket: Fix error path handling in rocket_job_run()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590 accel/rocket: Fix error path handling in rocket_job_run()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590

CVE-2026-89590 affects the Linux kernel's accel/rocket NPU driver. In rocket_job_run(), three error-path bugs exist: a dma_fence reference leak (the extra fence reference taken via dma_fence_get() is never released), a runtime PM usage counter leak (pm_runtime_get_sync() increments the counter ev...

CVE-2026-89546

CVE-2026-89546 affects the Linux kernel's SUNRPC subsystem, specifically the NFS callback service. A race condition during service teardown can cause two distinct issues: a resource leak when xprt_enqueue_bc_request() returns without enqueuing or freeing a committed request (and its associated xp...

CVE-2026-89527 svcrdma: Use svc_xprt_put to free listener on create failure

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

EUVD-2026-76418

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89512

CVE-2026-89512 is a device reference leak in the Linux kernel's remoteproc: scp subsystem. When the driver attempts to look up the SCP device's driver data before the driver has been bound, a reference to the device is taken but not properly dropped if the lookup fails. Holding a device reference...

CVE-2026-89512 remoteproc: scp: Fix device reference leak on failed lookup

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89512 remoteproc: scp: Fix device reference leak on failed lookup

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89512

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89473 power: supply: bq25890: Fix power_supply reference leak

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

CVE-2026-89473

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...