CVE-2026-64439

CVE-2026-64439: In the Linux kernel, the krb5 AEAD path could free a buffer while an async AEAD worker still held a pointer, causing a use-after-free (KASAN). The fix filters out async AEAD implementations at allocation time in krb5_aead_encrypt()/krb5_aead_decrypt() and corresponding rfc3961_sim...

CVE-2026-64439 crypto: krb5 - filter out async aead implementations at alloc

In the Linux kernel, the following vulnerability has been resolved: crypto: krb5 - filter out async aead implementations at alloc krb5aeadencrypt, krb5aeaddecrypt in rfc3961simplified.c and rfc8009encrypt, rfc8009decrypt in rfc8009aes2.c set a NULL completion callback and treat any negative retur...

EUVD-2026-48957

In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtables: zero chainstack array sashiko reports: looking at ebtables table translation, could a sparse cpupossiblemask lead to an uninitialized pointer free? If cpupossiblemask is sparse for example, CPU 0 and CPU 2 ar...

CVE-2026-64381

The CVE-2026-64381 issue is in the Linux kernel SMB client code path used by receive_encrypted_standard()/receive encrypted standard(): a next_buffer is allocated before validating that the number of compound PDUs has not exceeded MAX_COMPOUND. If the limit check fails, the function returns early...

CVE-2026-64377

In the Linux kernel, the cpufreq: qcom-cpufreq-hw driver has a double-free fix. qcom_cpufreq.data is allocated with devm_kzalloc() as a per-domain array, and qcom_cpufreq_hw_cpu_init() stores a pointer to an element in policy->driver_data. The driver’s exit path previously invoked kfree() on p...

EUVD-2026-48901

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfsexchmapsestimateoverhead adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINTMAX check still tests req-resblks. That is the reservation value from before t...

CVE-2026-64350

CVE-2026-64350 describes a memory leak in the Linux kernel USB cdnsp driver. The function cdnsp_alloc_stream_info() allocates stream_info->stream_ctx_array via cdnsp_alloc_stream_ctx() . If a later stream ring allocation or stream mapping update fails, the error path currently frees the alloca...

EUVD-2026-48894

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo cdnspallocstreaminfo allocates streaminfo-streamctxarray with cdnspallocstreamctx. If a later stream ring allocation or stream mapping update fails, the error path...

CVE-2026-64350 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo cdnspallocstreaminfo allocates streaminfo-streamctxarray with cdnspallocstreamctx. If a later stream ring allocation or stream mapping update fails, the error path...

CVE-2026-64350 usb: cdnsp: fix stream context array leak in cdnsp_alloc_stream_info()

In the Linux kernel, the following vulnerability has been resolved: usb: cdnsp: fix stream context array leak in cdnspallocstreaminfo cdnspallocstreaminfo allocates streaminfo-streamctxarray with cdnspallocstreamctx. If a later stream ring allocation or stream mapping update fails, the error path...

CVE-2026-64323

CVE-2026-64323 affects the Linux kernel UDF filesystem handling. The bug is in udf_load_vat() where the virtual partition start offset is taken from vat20->lengthHeader without validating against the VAT inode size, allowing a fully attacker-controlled 16-bit lengthHeader to underflow s_num_en...

EUVD-2026-49035

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

CVE-2026-64323

In the Linux kernel, the following vulnerability has been resolved: udf: validate VAT header length against the VAT inode size udfloadvat takes the virtual partition's start offset straight from the on-disk VAT 2.0 header without checking it against the VAT inode size:...

EUVD-2026-49009

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

CVE-2026-64297

CVE-2026-64297 concerns a Linux kernel module path in which module_extend_max_pages() calls kvrealloc() and returns -ENOMEM on failure, but the return value is never checked. If the initial allocation fails, info->pages is NULL and info->max_pages is 0; later calls to module_get_next_page()...

CVE-2026-64297 module: decompress: check return value of module_extend_max_pages()

In the Linux kernel, the following vulnerability has been resolved: module: decompress: check return value of moduleextendmaxpages moduleextendmaxpages calls kvrealloc internally and returns -ENOMEM on allocation failure. The return value is never checked. If the initial allocation fails,...

EUVD-2026-49004

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64292

The CVE-2026-64292 issue affects the Linux kernel iommufd path where veventq memory allocations occurred inside a spinlock. The underlying cause is that user-space-configured veventq depth could allow large queue allocations, exhausting atomic memory reserves. The mitigated fix moves the allocati...

CVE-2026-64292 iommufd: Move vevent memory allocation outside spinlock

In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queu...

CVE-2026-64288 KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invalidation occurs from MMU notifiers or TLBI instructions, and either can race against a vcpu not being onlined yet no pseudo-TLB allocated. Similarly, the TLB...