kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl()

A flaw was found in the Linux kernel. Specifically, within the drm/xe graphics driver, two error handling issues in the xeexecqueuecreateioctl function could lead to memory corruption. This could result in a dangling pointer or a use-after-free vulnerability. A local attacker could potentially...

CVE-2026-64254

CVE-2026-64254: In the Linux kernel NTB EPF path, a teardown path could call pci_iounmap() on the same iomem with an offset when BARs for PEER_SPAD and CONFIG are shared. The result was a kernel warning about vunmap() on a nonexistent vm area. A fix exists to unmap only when the two BARs used are...

CVE-2026-64255 wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: validate stamask before ffs in BA session handlers Three BA session handlers use ffsbadata-stamask - 1 to derive a station ID without checking that stamask is non-zero. When stamask is zero, ffs returns 0 and...

EUVD-2026-48653

In the Linux kernel, the following vulnerability has been resolved: drivers/base/memory: set mem-altmap after successful device registration If addmemoryblock fails at xastore under memory pressure for example, deviceunregister is called, which eventually triggers memoryblockrelease with mem-altm...

EUVD-2026-48650

In the Linux kernel, the following vulnerability has been resolved: gpio: rockchip: teardown bugs and resource leaks Address several teardown issues and resource leaks in the driver's remove path and error handling: 1. Debounce clock reference leak: The debounce clock bank-dbclk is obtained using...

CVE-2026-64240

Summary of CVE-2026-64240 (Linux kernel, igorplugusb): The issue arises from the igorplugusb driver when the control request setup packet was moved to an allocated usb_ctrlrequest pointer for DMA coherency, but the code still passed ir->request to usb_fill_control_urb(), causing the URB to poi...

CVE-2026-64231 drm/msm/dsi: don't dump registers past the mapped region

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

CVE-2026-64231

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dsi: don't dump registers past the mapped region On DSI 6G platforms the IO address space is internally adjusted by iooffset. Later this adjusted address might be used for memory dumping. However the size that is used for...

CVE-2026-64228

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

EUVD-2026-48636

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

CVE-2026-64228 net: ethtool: phy: avoid NULL deref when PHY driver is unbound

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: phy: avoid NULL deref when PHY driver is unbound phydev-drv can become NULL while the phydevice is still attached to its netdevice, namely after the PHY driver is unbound via sysfs: echo...

CVE-2026-64228

The CVE-2026-64228 issue affects the Linux kernel’s ethtool PHY driver: when a PHY driver is unbound via sysfs while the phy_device remains attached, phydev->drv can become NULL, causing ETHTOOL_MSG_PHY_GET to dereference a NULL drv. The root cause is that phy_remove() clears phydev->drv bu...

CVE-2026-64221 spi: ti-qspi: fix use-after-free after DMA setup failure

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to...

EUVD-2026-48629

In the Linux kernel, the following vulnerability has been resolved: spi: ti-qspi: fix use-after-free after DMA setup failure The driver falls back to PIO mode if DMA setup fails during probe. Make sure to clear the DMA channel pointer also if buffer allocation fails to avoid passing a pointer to...

CVE-2026-64219 drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Validate payload length and linkindex in dcprocessdmubauxtransferasync Why&How dcprocessdmubauxtransferasync copies payload-length bytes into a 16-byte stack buffer dpaux.data16 guarded only by an ASSERT, which i...

CVE-2026-64219

CVE-2026-64219 affects the Linux kernel drm/amd/display path, specifically dc_process_dmub_aux_transfer_async, where payload->length is copied into a 16-byte stack buffer (dpaux.data[16]) guarded only by an ASSERT(). If length > 16, this can cause a stack-based overflow; additionally, dc-&g...

EUVD-2026-48623

In the Linux kernel, the following vulnerability has been resolved: drm/msm/a6xx: Check kzalloc return in a8xxhfisendperftable Check the return value of kzalloc to prevent a NULL pointer dereference on allocation failure. Patchwork: https://patchwork.freedesktop.org/patch/721342/...

EUVD-2026-48618

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done...

CVE-2026-64210 net/mlx5e: xsk: Fix unlocked writing to ICOSQ

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: xsk: Fix unlocked writing to ICOSQ During napi poll, when the affinity changes and there's still XSK work to be done, we trigger an ICOSQ interrupt on the new CPU. However, this triggering on the ICOSQ is done...

CVE-2026-64209 phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config

In the Linux kernel, the following vulnerability has been resolved: phy: qcom: qmp-usbc: Fix out-of-bounds array access in dp swing config swingtbl and preemphasistbl are 4x4 arrays valid indices 0-3, but the boundary check uses " 4" instead of "= 4", allowing index 4 to cause an out-of-bounds...