CVE-2026-46079

In the Linux kernel, the following vulnerability has been resolved: rbd: fix null-ptr-deref when deviceadddisk fails dorbdadd publishes the device with deviceadd before calling deviceadddisk. If deviceadddisk fails after deviceadd succeeds, the error path calls rbdfreedisk directly and then later...

CVE-2026-46040 inotify: fix watch count leak when fsnotify_add_inode_mark_locked() fails

In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotifyaddinodemarklocked fails When fsnotifyaddinodemarklocked fails in inotifynewwatch, the error path calls inotifyremovefromidr but does not call decinotifywatches to undo the preceding...

CVE-2026-46040

In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotifyaddinodemarklocked fails When fsnotifyaddinodemarklocked fails in inotifynewwatch, the error path calls inotifyremovefromidr but does not call decinotifywatches to undo the preceding...

EUVD-2026-32421

In the Linux kernel, the following vulnerability has been resolved: inotify: fix watch count leak when fsnotifyaddinodemarklocked fails When fsnotifyaddinodemarklocked fails in inotifynewwatch, the error path calls inotifyremovefromidr but does not call decinotifywatches to undo the preceding...

CVE-2026-46040

CVE-2026-46040: In the Linux kernel inotify path, when fsnotify_add_inode_mark_locked() fails during inotify_new_watch(), the error path did not call dec_inotify_watches(), leaking a watch count and potentially exhausting max_user_watches (-ENOSPC) even with no active watches. The fix introduces ...

CVE-2026-46021 thermal: core: Fix thermal zone governor cleanup issues

In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone governor cleanup issues If thermalzonedeviceregisterwithtrips fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which ma...

EUVD-2026-32402

In the Linux kernel, the following vulnerability has been resolved: thermal: core: Fix thermal zone governor cleanup issues If thermalzonedeviceregisterwithtrips fails after adding a thermal governor to the thermal zone being registered, the governor is not removed from it as appropriate which ma...

EUVD-2026-32302

In the Linux kernel, the following vulnerability has been resolved: xfs: fix a resource leak in xfsallocbuftarg In the error path, call fsputdax to drop the DAX device reference...

CVE-2026-46005 xfs: fix a resource leak in xfs_alloc_buftarg()

In the Linux kernel, the following vulnerability has been resolved: xfs: fix a resource leak in xfsallocbuftarg In the error path, call fsputdax to drop the DAX device reference...

CVE-2026-45992

...

CVE-2026-45992

Affected software: Linux kernel ALSA caiaq. Issue: potential leak of internal URB ep1_in_urb in error path of setup_card() after an earlier fix, since ep1_in_urb could have been submitted before error handling. What’s fixed: ensure ep1_in_urb is properly handled/cleaned up in the error path as we...

CVE-2026-45992

Removed by vendor...

CVE-2026-45981

CVE-2026-45981 (Linux kernel, s390/cio): The vulnerability stems from device lifecycle mismanagement in css_alloc_subchannel() where, if dma_set_coherent_mask() or dma_set_mask() fails, the error path frees the subchannel without proper device model reference counting. After device_initialize() i...

CVE-2026-45964

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssauth kref leak in gssallocmsg error path Commit 5940d1cf9f42 "SUNRPC: Rebalance a kref in authgss.c" added a krefget&gssauth-kref call to balance the gssputauth done in gssreleasemsg, but forgot to add a...

CVE-2026-45964 SUNRPC: fix gss_auth kref leak in gss_alloc_msg error path

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix gssauth kref leak in gssallocmsg error path Commit 5940d1cf9f42 "SUNRPC: Rebalance a kref in authgss.c" added a krefget&gssauth-kref call to balance the gssputauth done in gssreleasemsg, but forgot to add a...

CVE-2026-45961

CVE-2026-45961 in the Linux kernel’s GFS2 filesystem is fixed: memory leaks occur on gfs2_fill_super() error paths when transitioning to read-write mode. Two leaks are addressed: (1) kernel thread objects (logd, quotad) not destroyed after init_threads() if failure occurs; (2) a quota bitmap buff...

CVE-2026-45961 gfs2: fix memory leaks in gfs2_fill_super error path

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix memory leaks in gfs2fillsuper error path Fix two memory leaks in the gfs2fillsuper error handling path when transitioning a filesystem to read-write mode fails. First leak: kthread objects threadstruct, taskstruct, etc...

CVE-2026-45947

CVE-2026-45947 concerns a memory leak in the Linux kernel DRM/AMD GPU code: amdgpu_acpi_enumerate_xcc() may return -ENOMEM from amdgpu_acpi_dev_init() without freeing the allocated xcc_info, causing a leak. The linked fixes in the Ubuntu/RootOS/NVD/SUSE entries indicate a patch to ensure xcc_info...

CVE-2026-45922

CVE-2026-45922 concerns the Linux kernel RDMA/mlx5 component. The vulnerability stems from MLX5_IB_METHOD_GET_DATA_DIRECT_SYSFS_PATH: when the device path length exceeds the output buffer, the function returns -ENOSPC but fails to free memory allocated via kobject_get_path(), causing a memory lea...

CVE-2026-45899

Summary: CVE-2026-45899 is a Linux kernel ext4 issue corrected by dropping all remaining potentially stale extents when a split extent operation fails. What happens: If a split extent fails, some extents may remain in processing and an error is returned, leaving stale entries in the extent status...