CVE-2026-80990 net: thunderbolt: Release the Rx HopID that was handed out on mismatch

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Release the Rx HopID that was handed out on mismatch tbxdomainallocinhopid passes the wanted HopID to idaallocrange as the lower bound, so a taken id is not an error there: the allocator returns the next free on...

EUVD-2026-45455

In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2cgetadapter which takes a reference to the embedded struct device. Make sure that the adapter including its struct device has been...

CVE-2026-53399

In the Linux kernel, the following vulnerability has been resolved: nfsd: release layout stid on setlease failure nfs4allocstid publishes the new stid into cl-clstateids via idralloccyclic under cllock before returning to nfsd4alloclayoutstateid. When nfsd4layoutsetlease then fails, the error pat...

PT-2026-61104

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory management issue exists in the nfsd component. When nfsd4 layout setlease fails, the error path incorrectly frees the layout stateid using kmem cache free without calling idr...

CVE-2026-52966

A flaw was found in the Linux kernel's Direct Rendering Manager DRM subsystem. A logical error in the 'change handle' logic, specifically related to the replacement of IDR ID allocator pointers, could lead to a kernel warning or system panic. This issue could allow a local attacker to trigger a...

EUVD-2026-38834

In the Linux kernel, the following vulnerability has been resolved: drm: Replace old pointer to new idr Commit 5e28b7b94408 introduced a logical error by failing to replace the newly generated IDR pointer to old id's pointer at the correct location within the "change handle" logic; this resulted ...

CVE-2026-52923

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

CVE-2026-52923

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

CVE-2026-52923

In the Linux kernel, the following vulnerability has been resolved: ipc: limit nextid allocation to the valid ID range The checkpoint/restore sysctl path can request the next SysV IPC id through ids-nextid. ipcidralloc currently forwards that request to idralloc with an open-ended upper bound. If...

PT-2026-52241

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Direct Rendering Manager DRM Graphics Execution Manager GEM subsystem of the Linux kernel. The issue occurs within the change handle ioctl during concurren...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: ICE: Avoid crashes due to unnecessary IDA frees. In the “remove path”, there is an attempt to free the auxidx IDA, regardless of whether it was allocated or not. This could potentially cause a crash when unloading the driver on...

PT-2026-51716

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free flaw exists in the ipc idr alloc function within the checkpoint/restore path for SysV Inter-Process Communication IPC ID allocation. The function forwards requests to id...

CVE-2023-54206

The CVE is a Linux kernel issue in net/sched/flower where an idr initialization was moved too early in fl_change(), allowing a concurrently initialized filter to be accessed and potentially dereferenced. The published fix inserts a NULL pointer into idr early to allocate a handle but ensures fl_g...

CVE-2023-54147

In the Linux kernel, the following vulnerability has been resolved: media: platform: mtk-mdp3: Add missing check and free for idaalloc Add the check for the return value of the idaalloc in order to avoid NULL pointer dereference. Moreover, free allocated "ctx-id" if mdpm2mopen fails later in orde...

CVE-2023-53363 PCI: Fix use-after-free in pci_bus_release_domain_nr()

In the Linux kernel, the following vulnerability has been resolved: PCI: Fix use-after-free in pcibusreleasedomainnr Commit c14f7ccc9f5d "PCI: Assign PCI domain IDs by idaalloc" introduced a use-after-free bug in the bus removal cleanup. The issue was found with kfence: 19.293351 BUG: KFENCE:...

DEBIAN-CVE-2024-58078

In the Linux kernel, the following vulnerability has been resolved: misc: miscminoralloc to use ida for all dynamic/misc dynamic minors miscminoralloc was allocating id using ida for minor only in case of MISCDYNAMICMINOR but miscminorfree was always freeing ids using idafree causing a mismatch a...

kernel: dax: Fix dax_mapping_release() use after free

A use-after-free vulnerability was found in the Linux kernel's device-dax subsystem during mapping object cleanup. When removing a dax region provider, the child daxmapping objects attempt to free their ID allocator after the parent devdax object has already been released. This causes idafree to...

SUSE CVE-2024-43892

In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to memcgroupidr Commit 73f576c04b94 "mm: memcontrol: fix cgroup creation failure after many small jobs" decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It...

AZL-48662 CVE-2024-43892 affecting package kernel for versions less than 5.15.167.1-1

In the Linux kernel, the following vulnerability has been resolved: memcg: protect concurrent access to memcgroupidr Commit 73f576c04b94 "mm: memcontrol: fix cgroup creation failure after many small jobs" decoupled the memcg IDs from the CSS ID space to fix the cgroup creation failures. It...

USN-6740-1: Linux kernel vulnerabilities

Wei Chen discovered that a race condition existed in the TIPC protocol implementation in the Linux kernel, leading to a null pointer dereference vulnerability. A local attacker could use this to cause a denial of service system crash. CVE-2023-1382 It was discovered that the virtio network...