CVE-2026-98778

The Linux kernel 's binder driver contains a vulnerability where a TF_UPDATE_TXN transaction superseding a pending async transaction incorrectly sets the is_failure flag to false. Because the transaction was never delivered, binder_apply_fd_fixups() is skipped, leaving stale buffer contents. The ...

EUVD-2026-103863

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

EUVD-2026-103862

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98777

The Linux kernel contains a memory leak vulnerability within the binder component. When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed using kfree() directly. This process omits the necessary call to binder_free_txn_fixups...

CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

EUVD-2026-103940

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

CVE-2026-98686 smb: client: discard post-EOF pagecache when extending a file via zero range

In the Linux kernel, the following vulnerability has been resolved: smb: client: discard post-EOF pagecache when extending a file via zero range smb3zerorange removed the pagecache only for the range being zeroed, so when it extends the file the folio straddling the old EOF - which may hold data...

CVE-2026-98682

The Linux kernel contains a vulnerability in the SMB client where cifs_file_copychunk_range() and the FICLONE path of cifs_remap_file_range() fail to properly serialize the destination page cache during server-side copy/clone operations. Specifically, these functions do not hold the invalidate_lo...

CVE-2026-98682 smb: client: drain and invalidate before server-side copy/clone

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

EUVD-2026-103936

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

CVE-2026-98682 smb: client: drain and invalidate before server-side copy/clone

In the Linux kernel, the following vulnerability has been resolved: smb: client: drain and invalidate before server-side copy/clone cifsfilecopychunkrange and the clone FICLONE path of cifsremapfilerange do not serialise the destination page cache against the server-side copy the way the other...

CVE-2026-98553

The Linux kernel contains a vulnerability in the autofs component where a pipe struct file reference is permanently leaked. This occurs when autofs_fill_super() fails before clearing the AUTOFS_SBI_CATATONIC flag—specifically during find_get_pid() failures on invalid pgrp mount options or when an...

CVE-2026-98553 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

EUVD-2026-103598

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

CVE-2026-98553

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

CVE-2026-98553 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

curl: curl EXPIRE_SHUTDOWN timer never armed for silent servers: connection-shutdown timeout bypass in cshutdn (event-driven mode)

Summary curl's non-blocking connection shutdown machinery lib/cshutdn.c is supposed to enforce a 2-second shutdown timeout DEFAULTSHUTDOWNTIMEOUTMS on connections whose peer never answers the graceful shutdown. In curlmultisocketaction event-driven mode the machinery deadlocks: the only code that...

CVE-2026-112059

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...

EUVD-2026-103521

libLAS through 1.8.1 contains a heap out-of-bounds write vulnerability in the point record reader caused by truncating the schema byte size to 16 bits when sizing the point buffer. Attackers can craft a .las file with a LASSchema variable length record whose schema exceeds 65535 bytes, so tools...