EUVD-2026-53770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...

CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

Linux Distros Unpatched Vulnerability : CVE-2026-64517

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in...

SUSE CVE-2026-64377

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

SUSE CVE-2026-64492

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devmiiotriggerregister tmp006probe allocates the DRDY trigger with devmiiotriggeralloc but registers it with plain iiotriggerregister. The driver has no .remove callback, so on module unload the...

SUSE CVE-2026-64517

In the Linux kernel, the following vulnerability has been resolved: drm/xe/gsc: Fix double-free of managed BO in error path The error path in xegscinitposthwconfig explicitly frees a BO allocated with xemanagedbocreatepinmap via xebounpinmapnovm. Since the managed BO already has a devm cleanup...

UBUNTU-CVE-2026-64492

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devmiiotriggerregister tmp006probe allocates the DRDY trigger with devmiiotriggeralloc but registers it with plain iiotriggerregister. The driver has no .remove callback, so on module unload the...

UBUNTU-CVE-2026-64377

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

EUVD-2026-48921

In the Linux kernel, the following vulnerability has been resolved: cpufreq: qcom-cpufreq-hw: Fix possible double free qcomcpufreq.data is allocated with devmkzalloc in probe as an array of per-domain data. qcomcpufreqhwcpuinit stores a pointer to one element of this array in policy-driverdata...

EUVD-2026-48909

In the Linux kernel, the following vulnerability has been resolved: HID: letsketch: fix UAF on inrangetimer at driver unbind letsketchdriver does not provide a .remove callback, but letsketchprobe arms a per-device timer: timersetup&data-inrangetimer, letsketchinrangetimeout, 0; The timer is...

PT-2026-64738

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double-free issue exists in the error path of the xe gsc init post hwconfig function. The function explicitly frees a Buffer Object BO allocated with xe managed bo create pin map using...

PT-2026-64713

In the Linux kernel, the following vulnerability has been resolved: iio: temperature: tmp006: use devm iio trigger register tmp006 probe allocates the DRDY trigger with devm iio trigger alloc but registers it with plain iio trigger register. The driver has no .remove callback, so on module unload...

SUSE CVE-2026-63861

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action aft...

PT-2026-64356

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The rockchip GPIO driver contains several teardown issues and resource leaks within its remove path and error handling. Specifically, the debounce clock bank-db clk is obtained via of cl...

SUSE CVE-2026-64050

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed becaus...

Linux Distros Unpatched Vulnerability : CVE-2026-63907

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: uio: uiopcigenericsva: fix double free of devmkzalloc memory uiopcisva allocates struct...

CVE-2026-63907

In the Linux kernel, the following vulnerability has been resolved: uio: uiopcigenericsva: fix double free of devmkzalloc memory uiopcisva allocates struct uiopcisvadev with devmkzalloc in probe, but then calls kfreeudev both on the probe error path label outfree and again in remove. Because...

CVE-2026-63907

The CVE concerns the Linux kernel driver for uio_pci_sva. The issue arises because uio_pci_sva_dev is allocated with devm_kzalloc() in probe() but is freed explicitly with kfree() both on the probe() error path and again in remove(). Since devm_kzalloc() memory is managed by the device core and i...

CVE-2026-63861 spi: mtk-snfi: unregister ECC engine on probe failure and remove() callback

In the Linux kernel, the following vulnerability has been resolved: spi: mtk-snfi: unregister ECC engine on probe failure and remove callback mtksnandprobe registers the on-host NAND ECC engine, but teardown was missing from both probe unwind and remove-time cleanup. Add a devm cleanup action aft...

PT-2026-61224

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A double free issue exists in the uio pci generic sva component. The uio pci sva structure is allocated using devm kzalloc within the probe function. However, the code explicitly calls...