CVE-2026-89590 accel/rocket: Fix error path handling in rocket_job_run()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590 accel/rocket: Fix error path handling in rocket_job_run()

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590

CVE-2026-89590 affects the Linux kernel's accel/rocket NPU driver. In rocket_job_run(), three error-path bugs exist: a dma_fence reference leak (the extra fence reference taken via dma_fence_get() is never released), a runtime PM usage counter leak (pm_runtime_get_sync() increments the counter ev...

EUVD-2026-76502

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89590

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

EUVD-2026-76475

In the Linux kernel, the following vulnerability has been resolved: ip: orphan prefetched skbs before multicast forwarding IPv4 and IPv6 input preserve an skb-sk association installed by bpfskassign so that local delivery can use the selected socket under RCU. Both address families can also...

CVE-2026-89564

CVE-2026-89564 is a use-after-free in the Linux kernel 's IP multicast forwarding path. When a socket prefetched by BPF (bpf_sk_assign) or UDP early demux is destroyed before the skb is freed, a later call to sock_pfree() dereferences the stale skb->sk pointer. Both IPv4 and IPv6 are affected:...

CVE-2026-89546

CVE-2026-89546 affects the Linux kernel's SUNRPC subsystem, specifically the NFS callback service. A race condition during service teardown can cause two distinct issues: a resource leak when xprt_enqueue_bc_request() returns without enqueuing or freeing a committed request (and its associated xp...

EUVD-2026-76442

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

CVE-2026-89536 SUNRPC: wait for in-flight client TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

CVE-2026-89536

CVE-2026-89536 is a race condition in the Linux kernel SUNRPC subsystem's client TLS handshake process. When a handshake is cancelled due to a timeout or signal, the synchronous waiter can prematurely drop the reference to the lower transport if the completion callback is still in flight, leading...

CVE-2026-89536 SUNRPC: wait for in-flight client TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xstlshandshakesync gives xstlshandshakedone a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops...

EUVD-2026-76433

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89527

This Linux kernel vulnerability affects the svcrdma (RPC/NFS RDMA server) subsystem. The root cause is an improper error-path cleanup in svc_rdma_create(): when svc_rdma_create_listen_id() fails, the code calls kfree() on the transport structure, bypassing svc_xprt_free(). This leaks the net name...

CVE-2026-89527 svcrdma: Use svc_xprt_put to free listener on create failure

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89527 svcrdma: Use svc_xprt_put to free listener on create failure

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89527

In the Linux kernel, the following vulnerability has been resolved: svcrdma: Use svcxprtput to free listener on create failure svcrdmacreate calls kfreecmaxprt when svcrdmacreatelistenid fails. svcxprtinit has already acquired a net namespace reference via getnettrack; kfree bypasses svcxprtfree...

CVE-2026-89512 remoteproc: scp: Fix device reference leak on failed lookup

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89512

CVE-2026-89512 is a device reference leak in the Linux kernel's remoteproc: scp subsystem. When the driver attempts to look up the SCP device's driver data before the driver has been bound, a reference to the device is taken but not properly dropped if the lookup fails. Holding a device reference...

CVE-2026-89512 remoteproc: scp: Fix device reference leak on failed lookup

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...