CVE-2026-98054 ASoC: Intel: avs: Fix unbalanced module reference count

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

CVE-2026-97971

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

CVE-2026-97969 watchdog: msc313e: Fix clock leak and spurious timer in settimeout()

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix clock leak and spurious timer in settimeout msc313ewdtsettimeout unconditionally calls msc313ewdtstart which introduces two severe bugs: 1. If the watchdog is already active, calling start again will increa...

CVE-2026-97946

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97946

The Linux kernel contains a flaw in the x86/amd_node architecture involving incorrect PCI device reference counting within the amd_smn_init() function. The issue stems from a local "root" pointer used as a temporary variable during device searching, where refcounts related to search iterators wer...

CVE-2026-97933

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the tracearray's topts array. This element has information to find...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97558

The Linux kernel contains a vulnerability in the SMB client where a cifsFileInfo reference leak occurs during a deferred close operation. The issue stems from a race condition in cifs_close(): if deferred_close_scheduled becomes false while work is pending, subsequent cifs_open() calls may reuse ...

CVE-2026-97558

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97558 smb: client: fix cifsFileInfo reference leak in deferred close

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

EUVD-2026-86866

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

EUVD-2026-86865

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97898

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

EUVD-2026-86829

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-97898 Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

Insecure Direct Object Reference / missing object-level authorization in the Akia keyless entry cloud service. The unlock action is relying on a client-supplied room/door identifier that is not properly authorized server-side against the authenticated guest's booking. An authenticated guest could...

CVE-2026-93399

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

CVE-2026-93399 Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...

CVE-2026-93399 Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

The Bookly plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 28.2 via the 'booklygetformid', 'booklyrendercomplete', 'booklyaddtocalendar' and 'booklyrollbackorder' AJAX actions. This is due to the 'booklygetformid' handler blindly storing th...