CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64044

Concrete details confirm CVE-2026-64044 fix in the Linux kernel’s OpenVPN peer handling. The error path in ovpn_nl_peer_new_doit() previously called ovpn_peer_release() directly instead of ovpn_peer_put(), bypassing the kref, risking use-after-free when a caller holds a ref during an in-flight op...

CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64016

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix durable reconnect error path file lifetime After a durable reconnect succeeds, ksmbdreopendurablefd republishes the same ksmbdfile into the session volatile-id table. If smb2open then takes a later error path, cleanup...

CVE-2026-63953 mm/migrate_device: fix pgtable leak in migrate_vma_insert_huge_pmd_page

In the Linux kernel, the following vulnerability has been resolved: mm/migratedevice: fix pgtable leak in migratevmainserthugepmdpage When migratevmainserthugepmdpage jumps to unlockabort due to a PMD check failure, the pgtable allocated earlier via pteallocone is never freed, causing a memory...

EUVD-2026-45703

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

CVE-2026-63930

CVE-2026-63930 — Linux kernel iio: buffer: hw-consumer : The use-after-free occurs in the err_put_buffers cleanup path of iio_hw_consumer_alloc(), where the code used list_for_each_entry() to call iio_buffer_put() on each buffer. If a buffer’s refcount dropped to 0, iio_buffer_put() could free th...

CVE-2026-63930 iio: buffer: hw-consumer: fix use-after-free in error path

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

CVE-2026-63907

In the Linux kernel, the following vulnerability has been resolved: uio: uiopcigenericsva: fix double free of devmkzalloc memory uiopcisva allocates struct uiopcisvadev with devmkzalloc in probe, but then calls kfreeudev both on the probe error path label outfree and again in remove. Because...

CVE-2026-63885 drm/gem: fix race between change_handle and handle_delete

In the Linux kernel, the following vulnerability has been resolved: drm/gem: fix race between changehandle and handledelete drmgemchangehandleioctl leaves the old handle live in the IDR during the window between spinunlocktablelock and the final spinlocktablelock. A concurrent drmgemhandledelete ...

CVE-2026-63820 f2fs: fix missing read bio submission on large folio error

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix missing read bio submission on large folio error f2fsreaddatalargefolio can keep a read bio across multiple readahead folios. If a later folio hits an error before any of its blocks are added to the bio, folioinbio is...

EUVD-2026-45463

In the Linux kernel, the following vulnerability has been resolved: rpmsg: char: Fix use-after-free on probe error path rpmsgchrdevprobe stores the newly allocated eptdev in the default endpoint's priv pointer before calling rpmsgchrdeveptdevadd. If rpmsgchrdeveptdevadd then fails, its error path...

CVE-2026-63797

The CVE-2026-63797 fix addresses a use-after-free in the Linux kernel rpmsg character device path. If rpmsg_chrdev_eptdev_add() fails after rpmsg_chrdev_probe() stores the new eptdev in the default endpoint’s priv pointer, the eptdev may be freed while callbacks still access the stale priv. The p...

CVE-2026-63795

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

EUVD-2026-45461

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

CVE-2026-63795 9p: avoid putting oldfid in p9_client_walk() error path

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

CVE-2026-63795 9p: avoid putting oldfid in p9_client_walk() error path

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

CVE-2026-63795

CVE-2026-63795 affects the Linux kernel 9p client implementation. The issue occurs when p9_client_walk() is called with clone=false and the fid aliases oldfid; if the walk fails after a request is sent, the error path may clunk the fid and destroy oldfid even when the caller still owns it, causin...