CVE-2026-63910

A flaw was found in the Linux kernel's dma-buf Direct Memory Access buffer subsystem. A race condition in the dmabuffd tracepoint can lead to a Use-After-Free UAF vulnerability. A local attacker could exploit this by closing a file descriptor fd prematurely, causing the dmabuf to be freed while t...

Linux Distros Unpatched Vulnerability : CVE-2026-63910

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before...

SUSE CVE-2026-63800

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

CVE-2026-63910

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-64164 btrfs: tracepoints: fix sleep while in atomic context in btrfs_sync_file()

In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfssyncfile The trace event btrfssyncfile is called in an atomic context all trace events are and its call to dput, which is needed due to the call to dgetparent, can...

CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

EUVD-2026-45683

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63910

The CVE-2026-63910 entry describes a Linux kernel vulnerability in dma-buf: a slab-use-after-free (UAF) in the dma_buf_fd() tracepoint. The fault arises because FD_ADD() leaves the allocated file descriptor live in the table; a racing thread can close() the fd before the DMA_BUF_TRACE() tracepoin...

CVE-2026-63800

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

CVE-2026-63800

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout()

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

EUVD-2026-45466

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

CVE-2026-63800

CVE-2026-63800 — Linux kernel (pNFS use-after-free) Affected: kernel code handling pnfs_update_layout() for NFS_LAYOUT_RETURN.Cause: If pnfs_prepare_to_retry_layoutget(lo) succeeds, pnfs_put_layout_hdr(lo) runs before trace_pnfs_update_layout(), while the tracepoint still references the structure...

CVE-2026-63800 pNFS: Fix use-after-free in pnfs_update_layout()

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfsupdatelayout When hitting the NFSLAYOUTRETURN branch in pnfsupdatelayout, the code calls pnfspreparetoretrylayoutgetlo. If it succeeds, pnfsputlayouthdrlo is called before tracepnfsupdatelayout,...

PT-2026-61116

In the Linux kernel, the following vulnerability has been resolved: pNFS: Fix use-after-free in pnfs update layout When hitting the NFS LAYOUT RETURN branch in pnfs update layout, the code calls pnfs prepare to retry layoutgetlo. If it succeeds, pnfs put layout hdrlo is called before trace pnfs...

PT-2026-61227

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dma buf fd tracepoint Once FD ADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMA BUF TRACE runs. The close drops the last reference, fput frees the...

net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint

...

SUSE CVE-2026-52941

In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn-lnk in smcmsgevent tracepoint The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc-conn.lnk: stringname, smc-conn.lnk-ibname conn-lnk is onl...

CVE-2026-52941

A flaw was found in the Linux kernel's net/smc module. An unprivileged local user could trigger a null pointer dereference by performing sendmsg or recvmsg operations on an SMC-D Shared Memory Communications - Direct socket while the smcmsgevent tracepoint is enabled. This can lead to a general...