CVE-2026-63910

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63883

In the Linux kernel, the following vulnerability has been resolved: serial: qcomgeni: fix kfifo underflow when flush precedes DMA completion IRQ When uartflushbuffer runs before the DMA completion IRQ is delivered, the following race can occur all steps serialized by uartportlock: 1. DMA starts:...

CVE-2026-64169 spi: ep93xx: fix error pointer deref after DMA setup failure

In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error...

CVE-2026-64169

In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error...

CVE-2026-64169 spi: ep93xx: fix error pointer deref after DMA setup failure

In the Linux kernel, the following vulnerability has been resolved: spi: ep93xx: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error...

CVE-2026-64170 spi: qup: fix error pointer deref after DMA setup failure

In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer...

EUVD-2026-45855

In the Linux kernel, the following vulnerability has been resolved: spi: qup: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to the clear the DMA channel pointers on setup failure to avoid dereferencing an error pointer...

CVE-2026-64170

Technical details (affected component, root cause, impact, patches) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2026-64168 spi: sprd: fix error pointer deref after DMA setup failure

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe...

CVE-2026-64168

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe...

CVE-2026-64168 spi: sprd: fix error pointer deref after DMA setup failure

In the Linux kernel, the following vulnerability has been resolved: spi: sprd: fix error pointer deref after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to check the dma.enabled flag before trying to release the DMA channels also on late probe...

CVE-2026-64168

The CVE-2026-64168 entry describes a Linux kernel SPI driver issue (spi: sprd) where a DMA setup failure could lead to a dereferenced error pointer or double-release of DMA channels. The fix makes the driver fall back to PIO on DMA setup failure and adds a check of the dma.enabled flag before rel...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

EUVD-2026-45834

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149

In the Linux kernel, CVE-2026-64149 fixes a DMA mapping sanity check: dma_map_resource() previously relied on pfn_valid() to exclude RAM, but this could misclassify MMIO regions sharing a sparsemem section as usable RAM, triggering a WARN_ON_ONCE and DMA_MAPPING_ERROR on platforms like Raspberry ...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64145 wifi: wilc1000: fix dma_buffer leak on bus acquire failure

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dmabuffer leak on bus acquire failure wilcwlanfirmwaredownload allocates dmabuffer with kmalloc at the top of the function and uses a 'fail:' label to free it via kfreedmabuffer on error. All later error paths...

CVE-2026-64145

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix dmabuffer leak on bus acquire failure wilcwlanfirmwaredownload allocates dmabuffer with kmalloc at the top of the function and uses a 'fail:' label to free it via kfreedmabuffer on error. All later error paths...

CVE-2026-64145

In the Linux kernel WiFi driver wilc1000, a memory-leak in firmware download was fixed: wilc_wlan_firmware_download() allocates dma_buffer with kmalloc() and, on early failure after the first acquire_bus(), could return without freeing the buffer. The code now uses a goto fail cleanup path to ens...