EUVD-2026-45784

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Fix use-after-free of CPU job query arrays on error path The CPU job ioctl's fail label calls kvfree on cpujob's timestamp and performance query arrays after v3djobcleanup, which drops the job's last reference and frees...

CVE-2026-64099

The CVE-2026-64099 entry describes a Linux kernel vulnerability in DRM/V3D where CPU job query arrays could be read after the job is freed on error paths, causing a use-after-free. The root cause is reading cpu_job after v3d_job_cleanup() and in early failure paths, where v3d_job_deallocate() zer...

EUVD-2026-45772

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject implausible blackbox recordcount adm1266nvmemreadblackbox loops over a recordcount that comes straight from byte 3 of the BLACKBOXINFO response. The destination buffer is data-devmem, sized for the nvm...

CVE-2026-64087

In the Linux kernel hwmon subsystem (pmbus/adm1266), adm1266_nvmem_read_blackbox() could loop using a record_count from BLACKBOX_INFO, risking a read past data->dev_mem when a device reports >32 records (due to firmware, bus issues, or 0xff). The fix caps the record_count at ADM1266_BLACKBO...

CVE-2026-64084 hwmon: (pmbus/adm1266) cap PDIO scan in get_multiple at ADM1266_PDIO_NR

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

EUVD-2026-45657

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 cap PDIO scan in getmultiple at ADM1266PDIONR adm1266gpiogetmultiple iterates the PDIO portion of the caller-supplied mask using foreachsetbitfromgpionr, mask, ADM1266GPIONR + ADM1266PDIOSTATUS ... where...

CVE-2026-64083 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...

EUVD-2026-45656

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...

CVE-2026-64083 hwmon: (pmbus/adm1266) reject short block-read responses in the GPIO accessors

In the Linux kernel, the following vulnerability has been resolved: hwmon: pmbus/adm1266 reject short block-read responses in the GPIO accessors adm1266gpioget and adm1266gpiogetmultiple both compose the pin-status word as pinsstatus = readbuf0 + readbuf1 8; right after i2csmbusreadblockdata,...

CVE-2026-64083

The CVE-2026-64083 vulnerability affects Linux kernel hwmon drivers for pmbus/adm1266. adm1266_gpio_get() and adm1266_gpio_get_multiple() build a pin-status word from i2c_smbus_read_block_data() without validating the returned length, allowing 0- or 1-byte responses to yield uninitialized stack d...

EUVD-2026-45642

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix cancellation of a DIO and single read subrequests When the preparation of a new subrequest for a read fails, if the subrequest has already been added to the stream-subrequests list, it can't simply be put and abandoned...

CVE-2026-64060 netfs: Fix leak of request in netfs_write_begin() error handling

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfswritebegin error handling Fix netfswritebegin to not leak our ref on the request in the event that we get an error from netfswaitforread...

EUVD-2026-45633

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix leak of request in netfswritebegin error handling Fix netfswritebegin to not leak our ref on the request in the event that we get an error from netfswaitforread...

CVE-2026-64060

In the Linux kernel netfs subsystem, CVE-2026-64060 fixes a leak of the request reference in netfs_write_begin() when an error occurs in netfs_wait_for_read(). The issue was resolved by adjusting error handling to avoid leaking the request’s ref. This entry contains concrete details about the aff...

CVE-2026-64056 net: ethernet: cortina: Make RX SKB per-port

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-64052 block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in biointegritymapuser pinuserpagesfast can partially succeed and return the number of pages that were actually pinned. However, the biointegritymapuser does not handle this partial pinnin...

CVE-2026-64052 block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in biointegritymapuser pinuserpagesfast can partially succeed and return the number of pages that were actually pinned. However, the biointegritymapuser does not handle this partial pinnin...

CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64044

Concrete details confirm CVE-2026-64044 fix in the Linux kernel’s OpenVPN peer handling. The error path in ovpn_nl_peer_new_doit() previously called ovpn_peer_release() directly instead of ovpn_peer_put(), bypassing the kref, risking use-after-free when a caller holds a ref during an in-flight op...

CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...