CVE-2026-89996

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996 dma-buf: dma-heap: don't publish fd before copy_to_user() succeeds

In the Linux kernel, the following vulnerability has been resolved: dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma-buf and installs an fd into the caller's fd table via dmabuffd - fdinstall before dmaheapioctl copies the result back to userspace. ...

CVE-2026-89996

CVE-2026-89996 affects the Linux kernel 's dma-heap subsystem. In DMA_HEAP_IOCTL_ALLOC, the file descriptor is installed into the caller's fd table via fd_install() before copy_to_user() completes. If copy_to_user() fails, the fd and its underlying dma-buf reference are leaked for the process lif...

Linux Distros Unpatched Vulnerability : CVE-2026-89996

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dma-buf: dma-heap: don't publish fd before copytouser succeeds DMAHEAPIOCTLALLOC allocates a dma- buf and installs an fd into the caller's fd table via dmabuffd...

CVE-2026-63910

The CVE-2026-63910 entry describes a Linux kernel vulnerability in dma-buf: a slab-use-after-free (UAF) in the dma_buf_fd() tracepoint. The fault arises because FD_ADD() leaves the allocated file descriptor live in the table; a racing thread can close() the fd before the DMA_BUF_TRACE() tracepoin...

SUSE CVE-2025-38722

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...

DEBIAN-CVE-2025-38722

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...

CVE-2025-38722 habanalabs: fix UAF in export_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: habanalabs: fix UAF in exportdmabuf As soon as we'd inserted a file reference into descriptor table, another thread could close it. That's fine for the case when all we are doing is returning that descriptor to userland it's a...

CVE-2025-38409: Missing Release of Memory after Effective Lifetime

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix another leak in the submit error path putunusedfd doesn't free the installed file, if we've already done fdinstall. So we need to also free the syncfile. Patchwork: https://patchwork.freedesktop.org/patch/653583/...

CVE-2024-40913 cachefiles: defer exposing anon_fd until after copy_to_user() succeeds

In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anonfd until after copytouser succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but ...

CVE-2024-40913

Technical details for CVE-2024-40913 are not provided in the supplied documents. Monitor for updates from vendors/advisories.

CVE-2024-40913: Use After Free

In the Linux kernel, the following vulnerability has been resolved: cachefiles: defer exposing anonfd until after copytouser succeeds After installing the anonymous fd, we can now see it in userland and close it. However, at this point we may not have gotten the reference count of the cache, but ...

UBUNTU-CVE-2022-48771

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix stale file descriptors on failed usercopy A failing usercopy of the fencerep object will lead to a stale entry in the file descriptor table as putunusedfd won't release it. This enables userland to refer to a...

GSD-2022-1000475 copy_process(): Move fd_install() out of sighand->siglock critical section

copyprocess: Move fdinstall out of sighand-siglock critical section This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.25 by commit...

GSD-2022-1000404 copy_process(): Move fd_install() out of sighand->siglock critical section

copyprocess: Move fdinstall out of sighand-siglock critical section This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.102 by commit...

PT-2022-28837

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.16.11 Description The issue concerns a potential security vulnerability in the Linux Kernel. It involves the copy process function and the movement of fd install out of the sighand-siglock critical section. Th...

PT-2022-28631

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to v5.4.181 Description The issue concerns a potential security vulnerability in the Linux Kernel. It involves the copy process function and the movement of fd install out of the sighand-siglock critical section. Th...