UBUNTU-CVE-2026-93215

In the Linux kernel, the following vulnerability has been resolved: cdx: Fix double free when sysfs file creation fails In cdxcreateresattr, if sysfscreatebinfile fails, the code frees resattr but doesn't set cdxdev-resattrnum to NULL. This leaves a dangling pointer in the array. Then...

CVE-2026-97424 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...

EUVD-2026-86037

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...

CVE-2026-97424

The Linux kernel contains a vulnerability in the drm/amdgpu/ras component related to the cp_ecc_error_irq interrupt. Specifically, the interrupt was acquired in amdgpu_gfx_ras_late_init() but released in gfx_v9_0_hw_fini(), creating a mismatch because the acquisition was skipped on SR-IOV VF . To...

CVE-2026-97424 drm/amdgpu/ras: add ras_suspend callback and use it for cp_ecc_error_irq

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/ras: add rassuspend callback and use it for cpeccerrorirq cpeccerrorirq is acquired in amdgpugfxraslateinit but released in gfxv90hwfini, so the put site has to query amdgpuirqenabled because the get is skipped on SR-I...

CVE-2026-93827 virtio-fs: avoid double-free on failed queue setup

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

CVE-2026-93827 virtio-fs: avoid double-free on failed queue setup

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

CVE-2026-93827

The Linux kernel is vulnerable to a double-free issue within the virtio-fs component during a failed queue setup. The root cause is that virtio_fs_setup_vqs() frees fs->vqs and fs->mq_map if virtio_find_vqs() fails, but subsequent cleanup in virtio_fs_ktype_release() attempts to free them a...

EUVD-2026-86216

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

CVE-2026-93810

The Linux kernel contains a vulnerability within the cachefiles component. The root cause is a double fput() call occurring during error handling in the cachefiles_create_tmpfile() function. This issue has been resolved in the kernel source. No specific exploit details or in-the-wild exploitation...

EUVD-2026-86197

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput in error handling in cachefilescreatetmpfile...

CVE-2026-93810 cachefiles: Fix double fput

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput in error handling in cachefilescreatetmpfile...

CVE-2026-93810 cachefiles: Fix double fput

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput in error handling in cachefilescreatetmpfile...

CVE-2026-93800

The Linux kernel contains a use-after-free (or double free) vulnerability in the btrfs filesystem. The issue occurs when btrfs_update_reloc_root() returns an error during the insert_dirty_subvol() function. This causes a root's reloc_root field to remain pointed at a freed reloc root instead of b...

CVE-2026-93800 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

EUVD-2026-86187

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

CVE-2026-93800 btrfs: fix use-after-free on reloc root after error in insert_dirty_subvol()

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

CVE-2026-93221

The Linux kernel is vulnerable to a race condition in the nfsd component due to a lack of serialization when accessing boolean fields in nfsd_net. Specifically, the nfsd4_end_grace() function uses a plain boolean for grace_ended, allowing concurrent paths—such as the laundromat path and the RECLA...

CVE-2026-93221 nfsd: convert nfsd_net boolean flags to unsigned long flags word

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...

EUVD-2026-85950

In the Linux kernel, the following vulnerability has been resolved: nfsd: convert nfsdnet boolean flags to unsigned long flags word nfsdnet contains several boolean fields that are accessed from concurrent contexts without serialization. In particular, nfsd4endgrace guards its drain path with a...