CVE-2026-97429

A Use-After-Free (UAF) race condition exists in the Linux kernel within the drm/amdkfd component, specifically in the destroy_queue_cpsch function. The vulnerability is caused by wait_on_destroy_queue() dropping locks while waiting for a queue resume, which allows a concurrent destroy operation t...

EUVD-2026-86042

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroyqueuecpsch waitondestroyqueue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use isbeingdestroyed flag to serialize destruction...

CVE-2026-97429 drm/amdkfd: fix UAF race in destroy_queue_cpsch

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroyqueuecpsch waitondestroyqueue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use isbeingdestroyed flag to serialize destruction...

EUVD-2026-86034

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Be careful about boundary conditions in ibumemfindbestpgsz Several corner cases, especially important on 32 bits: - umem-iova is u64, the function argument should pass in u64 or iova will be truncated - Check that the...

CVE-2026-97410

The Linux kernel contains a vulnerability in the netconsole component where the drop_netconsole_target() function unlinks a target while only holding the target_list_lock . This creates a race condition because netconsole_process_cleanups_core() iterates the target_cleanup_list under a different ...

CVE-2026-97410 netconsole: take target_cleanup_list_lock in drop_netconsole_target()

In the Linux kernel, the following vulnerability has been resolved: netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the underlying interface has been unregistered, netconsolenetdevevent moves t...

EUVD-2026-86023

In the Linux kernel, the following vulnerability has been resolved: netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the underlying interface has been unregistered, netconsolenetdevevent moves t...

CVE-2026-97410 netconsole: take target_cleanup_list_lock in drop_netconsole_target()

In the Linux kernel, the following vulnerability has been resolved: netconsole: take targetcleanuplistlock in dropnetconsoletarget dropnetconsoletarget unlinks the target while only holding targetlistlock. However, when the underlying interface has been unregistered, netconsolenetdevevent moves t...

CVE-2026-93829 smb: client: fix races in cifsd thread creation

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix races in cifsd thread creation The cifsd demultiplex thread can run and access tcpses before the parent thread has finished populating tcpses, which the worker thread accesses locklessly. Also, the kthreadrun mac...

EUVD-2026-86218

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix races in cifsd thread creation The cifsd demultiplex thread can run and access tcpses before the parent thread has finished populating tcpses, which the worker thread accesses locklessly. Also, the kthreadrun mac...

CVE-2026-93829 smb: client: fix races in cifsd thread creation

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix races in cifsd thread creation The cifsd demultiplex thread can run and access tcpses before the parent thread has finished populating tcpses, which the worker thread accesses locklessly. Also, the kthreadrun mac...

CVE-2026-93829

The Linux kernel contains a vulnerability in the smb: client component related to races in cifsd thread creation . Specifically, the cifsd demultiplex thread can access tcp_ses before the parent thread finishes populating it, as it is accessed locklessly. Additionally, the kthread_run macro may s...

CVE-2026-93822 PCI: iproc: Protect root bus removal with rescan lock

In the Linux kernel, the following vulnerability has been resolved: PCI: iproc: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead ...

EUVD-2026-86207

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

CVE-2026-93819 PCI: mediatek: Protect root bus removal with rescan lock

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

CVE-2026-93804

The Linux kernel contains a vulnerability in the wifi: mac80211 component related to IBSS (Independent Basic Service Set) disconnection. A cross-CPU race condition exists in ieee80211_ibss_disconnect() because the carrier is turned off and the driver is notified to leave before all in-flight tran...

CVE-2026-93804 wifi: mac80211: ibss: wait for in-flight TX on disconnect

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211ibssdisconnect mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be...

CVE-2026-93798

The Linux kernel contains a vulnerability in the btrfs filesystem regarding reloc root cleanup within the merge_reloc_roots() function. The issue occurs when a root with zero root references is processed; the system was resetting the ->reloc_root pointer without utilizing necessary memory barr...

CVE-2026-93798 btrfs: fix reloc root cleanup in merge_reloc_roots()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in mergerelocroots If the root we got has zero root refs in its root item, we are resetting the root's -relocroot without using barriers like we do everywhere else. Sashiko complained about this whil...

EUVD-2026-86164

In the Linux kernel, the following vulnerability has been resolved: f2fs: embed f2fsgckthread in f2fssbinfo Instead of allocating f2fsgckthread dynamically, embed it in f2fssbinfo. This simplifies lifetime management and prepares for fixing race conditions during teardown. - sbistore -...