CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

EUVD-2026-103653

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

CVE-2026-98608

The Linux kernel contains a vulnerability in the drm/virtio component where the virtio_gpu_resource_create_ioctl() function causes an object leak . Specifically, during the drm_gem_handle_create() error path, the code incorrectly calls drm_gem_object_release() instead of dropping the owned refere...

CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

CVE-2026-98607 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

CVE-2026-98607 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

CVE-2026-98607

The Linux kernel contains an object leak vulnerability within the drm/virtio component, specifically inside the virtio_gpu_resource_create_blob_ioctl() function. The root cause is that the function calls drm_gem_object_release() on error paths for both virtio_gpu_resource_assign_uuid() and drm_ge...

EUVD-2026-103652

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

CVE-2026-98606 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

CVE-2026-98606

A vulnerability in the Linux kernel affects the drm/virtio component. The virtio_gpu_vram_create() function improperly handles error paths by using a bare kfree(vram) after drm_gem_private_object_init() has executed. This causes the freed object to remain in the interval tree, leading to situatio...

CVE-2026-98606 drm/virtio: release the GEM object on virtio_gpu_vram_create() errors

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

EUVD-2026-103651

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

CVE-2026-98605 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98605

The Linux kernel contains a vulnerability in the drm/bridge: samsung-dsim driver related to improper TE GPIO lifetime management during host attach. The issue arose when the Exynos DSI driver was generalized into samsung-dsim , incorrectly mixing managed descriptors (devm_gpiod_get_optional()) wi...

CVE-2026-98605 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

EUVD-2026-103650

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98604 ovpn: replace bind when learning local endpoint

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

CVE-2026-98604

A vulnerability in the Linux kernel involves how struct ovpn_bind is handled during local endpoint learning. While the structure is published via peer->bind using RCU , the bind->local field is updated in place under peer->lock. Because UDP TX reads this field without acquiring that lock...

CVE-2026-98604 ovpn: replace bind when learning local endpoint

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

EUVD-2026-103649

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...