CVE-2026-64469

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binderthreadrelease When a thread exits, binderthreadrelease walks its transaction stack to clear the t-from and t-toproc that correspond with the exiting thread. However, a process dying in parallel might...

CVE-2026-64469 binder: fix UAF in binder_thread_release()

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF in binderthreadrelease When a thread exits, binderthreadrelease walks its transaction stack to clear the t-from and t-toproc that correspond with the exiting thread. However, a process dying in parallel might...

CVE-2026-64455 USB: chaoskey: Fix slab-use-after-free in chaoskey_release()

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

CVE-2026-64455

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

CVE-2026-64455

CVE-2026-64455 concerns the Linux kernel USB chaoskey driver. The vulnerability is a use-after-free in chaoskey_release: after the USB device is unplugged, a debugging log statement can access the usb_interface structure that has already been deallocated, potentially leading to a crash or memory ...

EUVD-2026-48799

In the Linux kernel, the following vulnerability has been resolved: USB: chaoskey: Fix slab-use-after-free in chaoskeyrelease The chaoskey driver has a use-after-free bug in its release routine. If the user closes the device file after the USB device has been unplugged, a debugging log statement...

CVE-2026-64447 staging: media: ipu7: fix double-free and use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: staging: media: ipu7: fix double-free and use-after-free in error paths In both ipu7isysinit and ipu7psysinit, pdata is allocated and then passed to ipu7businitializedevice, which stores it in adev-pdata. The ipu7busrelease...

EUVD-2026-48964

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

EUVD-2026-48920

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

CVE-2026-64358 media: mtk-jpeg: cancel workqueue on release for supported platforms only

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

EUVD-2026-48902

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64358 media: mtk-jpeg: cancel workqueue on release for supported platforms only

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64358

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64356

The CVE-2026-64356 issue affects the Linux kernel XFS metadir path, specifically a memory leak in xfs_dqinode_metadir_create() when xfs_metadir_create() fails inside xfs_dqinode_metadir_create(). The root cause is that, on failure, the code returns without freeing the allocated update and transac...

CVE-2026-64356 xfs: fix memory leak in xfs_dqinode_metadir_create()

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

EUVD-2026-48900

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

CVE-2026-64356 xfs: fix memory leak in xfs_dqinode_metadir_create()

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

EUVD-2026-48890

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64346

Summary: CVE-2026-64346 affects the Linux kernel USB gadget udc path. A race condition can occur when the udc (managing gadget state) is freed by usb_del_gadget() while gadget_match_driver() may still access the freed udc (e.g., via configfs). This Use-After-Free can trigger a NULL pointer derefe...

CVE-2026-64346 usb: gadget: udc: Fix use-after-free in gadget_match_driver

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....