CVE-2026-97495

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

CVE-2026-97494

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97493

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

CVE-2026-97492

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't call ieee80211handlereconfigfailure when not needed In case reconfiguration of NAN fails, we call ieee80211handlereconfigfailure, that marks all interfaces as not in the driver. Then, at the error path of th...

CVE-2026-97491

In the Linux kernel, the following vulnerability has been resolved: net/rds: Don't sleep inside rdsibconnpathshutdown New rds rdma self tests exposed a hang when tearing down the ib network configs. This is caused by the shutdown worker thread sleeping on the waitevent call, which blocks other wo...

CVE-2026-97490

In the Linux kernel, the following vulnerability has been resolved: affs: handle setblocksize failures affs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97489

In the Linux kernel, the following vulnerability has been resolved: bfs: handle setblocksize failures bfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97488

In the Linux kernel, the following vulnerability has been resolved: qnx4: handle setblocksize failures qnx4 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97487

In the Linux kernel, the following vulnerability has been resolved: jfs: handle setblocksize failures jfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97486

In the Linux kernel, the following vulnerability has been resolved: hpfs: handle setblocksize failures hpfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97485

In the Linux kernel, the following vulnerability has been resolved: omfs: handle setblocksize failures omfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97484

In the Linux kernel, the following vulnerability has been resolved: usbip: vhcihcd: fix NULL deref in statusshowvhci platformgetdrvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. statusshowvhci checked for a NULL pdev but not for a NULL hcd...

CVE-2026-97483

In the Linux kernel, the following vulnerability has been resolved: usb: core: hcd: fix possible deadlock in rh control transfers From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doi...

CVE-2026-97482

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

CVE-2026-97481

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix possible ISR soft lockup There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase. The reason for the soft lockup in the ISR is the missing FIFO...

CVE-2026-97480

In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: protect against NULL uart-port.dev in register serial8250register8250port conditionally copies uart-port.dev from up-port.dev only when up-port.dev is non-NULL: if up-port.dev uart-port.dev = up-port.dev; ... S...

CVE-2026-97479

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-97478

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrnirqfddeassign and the eventfd EPOLLHUP wakeup can race and free the same struct hsmirqfd: CPU0 CPU1 ---- ---- eventfdrelease wakeuppollEPOLLHUP hsmirqfdwakeup...

CVE-2026-97477

In the Linux kernel, the following vulnerability has been resolved: RDMA/counter: Fix numcounters leak on bindqp failure in allocandbind When rdmacounterbindqp fails in allocandbind, the error path jumps to errmode which frees the counter without decrementing portcounter-numcounters. The only pla...

CVE-2026-97476

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...