CVE-2026-64019 nvme-pci: fix dma mapping leak on data setup error

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing...

EUVD-2026-45592

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing...

CVE-2026-64019

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-64019 nvme-pci: fix dma mapping leak on data setup error

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix dma mapping leak on data setup error We're leaking the initial DMA mapping during iteration if we fail to allocate the tracking descriptor for both PRP and SGL. Unmap the iterator directly; we can't use the existing...

EUVD-2026-45591

In the Linux kernel, the following vulnerability has been resolved: net: mana: validate rxreqidx to prevent out-of-bounds array access In manahwcrxeventhandler, rxreqidx is derived from sge-address in DMA-coherent memory. In Confidential VMs SEV-SNP/TDX, this memory is shared unencrypted and HW c...

EUVD-2026-45702

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-63929

The CVE-2026-63929 issue is in the Linux kernel iio subsystem, specifically iio_buffer_enqueue_dmabuf() which allocates a iio_dma_fence and calls dma_resv_add_fence(). The initial reference from dma_fence_init() (kref=1) is not released on the success path, while dma_resv_add_fence() takes a seco...

CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

EUVD-2026-45683

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63910 dma-buf: fix UAF in dma_buf_fd() tracepoint

In the Linux kernel, the following vulnerability has been resolved: dma-buf: fix UAF in dmabuffd tracepoint Once FDADD returns, the fd is live in the file descriptor table and a thread sharing that table can close it before DMABUFTRACE runs. The close drops the last reference, fput frees the...

CVE-2026-63910

The CVE-2026-63910 entry describes a Linux kernel vulnerability in dma-buf: a slab-use-after-free (UAF) in the dma_buf_fd() tracepoint. The fault arises because FD_ADD() leaves the allocated file descriptor live in the table; a racing thread can close() the fd before the DMA_BUF_TRACE() tracepoin...

CVE-2026-63883 serial: qcom_geni: fix kfifo underflow when flush precedes DMA completion IRQ

In the Linux kernel, the following vulnerability has been resolved: serial: qcomgeni: fix kfifo underflow when flush precedes DMA completion IRQ When uartflushbuffer runs before the DMA completion IRQ is delivered, the following race can occur all steps serialized by uartportlock: 1. DMA starts:...

CVE-2026-63883

The CVE relates to the Linux kernel serial driver for Qualcomm GENI: a kfifo underflow race when uart_flush_buffer() runs before the DMA completion IRQ. The race sequence can cause stale DMA data to be submitted due to kfifo_len() being reset to 0 while tx_remaining is nonzero, leading to an inco...

CVE-2026-63880

CVE-2026-63880 affects the Linux kernel AMDGPU driver (drm/amdgpu) in the AMDGPU_GEM_OP_GET_MAPPING_INFO path. A -ENOMEM failure in kvcalloc could skip cleanup and leak three locks (drm_gem_object reference, drm_exec lock on the GEM, and drm_exec lock on the per-process VM root PD), causing a loa...

CVE-2026-63859 net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Add missing bits in airohaqdmacleanuptxqueue Similar to airohaqdmacleanuprxqueue, reset DMA TX descriptors in airohaqdmacleanuptxqueue routine. Moreover, reset TXDMAIDX to TXCPUIDX to notify the NIC the QDMA TX ring ...

PT-2026-61200

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the qcom geni serial driver when uart flush buffer is executed before the DMA completion interrupt request IRQ is delivered. If kfifo reset is called while a D...

PT-2026-61468

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the iommupt component where the driver could omit PAGE SIZE from the pgsize bitmap. While technically permitted, this behavior contradicts the intended design. The fix...

PT-2026-61227

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the dma buf fd tracepoint. This occurs because a thread sharing the file descriptor table can call close after FD ADD returns but before DMA BUF TRACE...