EUVD-2026-48845

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

CVE-2026-64501

In the Linux kernel, the following vulnerability has been resolved: iio: adc: adsigmadelta: fix CS held asserted and state leaks In adsigmadeltasingleconversion, setmodeADSDMODEIDLE and disableone were called from the out: block while keepcsasserted was still true. This caused any SPI transfer...

CVE-2026-64481

The CVE-2026-64481 vulnerability affects the Linux kernel ALSA subsystem for the cs35l41 HDA driver. The issue arises because ALSA controls created by cs35l41_hda can reference the cs35l41_hda object and queue firmware load work (fw_load_work). If the component/device is unbound or removed before...

CVE-2026-64477 x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled

In the Linux kernel, the following vulnerability has been resolved: x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled The architecture updates the cpumask in a domain's header to track which online CPUs are associated with the domain. When this mask becomes empty t...

CVE-2026-64475

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Release the VGA arbiter client on registerdevice failure The re-order in the Fixes commit below displaced vfiopcivgainit as the last failure point of what is now vfiopcicoreregisterdevice without introducing an unwind f...

CVE-2026-64476 vfio/pci: Latch disable_idle_d3 per device

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

CVE-2026-64476

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

CVE-2026-64476

The CVE-2026-64476 vulnerability affects the Linux kernel vfio-pci driver. The root cause was improper handling of the disable_idle_d3 flag, which initially could be changed globally and influenced per-device power states via runtime_power management (PM). The issue arose because the vfio-pci mod...

EUVD-2026-48820

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Latch disableidled3 per device When disableidled3 was introduced in vfio-pci, it directly manipulated the device power state with pcisetpowerstate. There were no refcounts to maintain or balanced operations, we could...

CVE-2026-64474

The CVE-2026-64474 issue affects the Linux kernel VFIO path, specifically vfio_mig_get_next_state() which walks vfio_from_fsm_table[] and could spin forever when encountering an ERROR sentinel (STOP_COPY arcs to ERROR). The root cause was an unaccounted ERROR sentinel in the skip loop, allowing a...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64474

In the Linux kernel, the following vulnerability has been resolved: vfio: prevent infinite loop in vfiomiggetnextstate on blocked arc vfiomiggetnextstate walks vfiofromfsmtable one step at a time, looping to skip optional states the device does not support until nextfsm is supported. A blocked...

CVE-2026-64472

The CVE-2026-64472 entries describe a Linux kernel fix for vfio/mlx5: a racy bitfield layout was tightened by splitting bitfields and moving certain flags to dedicated storage units. The root cause was non-atomic bitfield operations using read-modify-write patterns, which could lead to concurrent...

CVE-2026-64450 tipc: fix out-of-bounds read in broadcast Gap ACK blocks

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

CVE-2026-64450

CVE-2026-64450: In Linux kernel TIPC, a broadcast Gap ACK blocks record could be read out-of-bounds due to a missing check that the record fits in the message data area. The bug occurs when tipc_get_gap_ack_blks() validates the len against ugack/bgack counts but not msg_data_sz(), allowing a reco...

CVE-2026-64450 tipc: fix out-of-bounds read in broadcast Gap ACK blocks

In the Linux kernel, the following vulnerability has been resolved: tipc: fix out-of-bounds read in broadcast Gap ACK blocks A broadcast PROTOCOL/STATEMSG can carry a Gap ACK blocks record in its data area. tipcgetgapackblks only verifies that the record's len field is self-consistent with its...

EUVD-2026-48782

In the Linux kernel, the following vulnerability has been resolved: crypto: qat - fix VF2PF work teardown race in adfdisablesriov The VF2PF interrupt handler queues PF-side response work that stores a raw pointer to per-VF state struct adfaccelvfinfo. Currently, adfdisablesriov destroys per-VF...

EUVD-2026-48780

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

CVE-2026-64436

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...

CVE-2026-64436 net: af_key: initialize alg_key_len for IPComp states

In the Linux kernel, the following vulnerability has been resolved: net: afkey: initialize algkeylen for IPComp states pfkeymsg2xfrmstate handles the IPComp SADBXSATYPEIPCOMP case by allocating x-calg and copying only the algorithm name: x-calg = kmallocobjx-calg; if !x-calg err = -ENOMEM; goto...