CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

EUVD-2026-103875

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98789

The Linux kernel contains a vulnerability in the BPF subsystem where objects can become stuck in free_by_rcu_ttrace . This occurs because do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set, leaving objects in the trace buffer. Since the number of such objects is not bounde...

CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

EUVD-2026-103874

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98788 futex: Fix private hash use-after-free on resize

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98788 futex: Fix private hash use-after-free on resize

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

EUVD-2026-103873

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98788

The Linux kernel is affected by a use-after-free vulnerability in the futex subsystem during hash table resizing. The root cause is that __futex_pivot_hash() assigns mmph->batches before mmph->hash, allowing futex_ref_drop() to proceed while a reader still holds a pointer to the old hash if...

CVE-2026-98787

The Linux kernel contains a vulnerability in the bpf subsystem due to missing migration protection in __rhtab_map_lookup_and_delete_batch() . The function calls bpf_mem_cache_free_rcu() , which utilizes this_cpu_ptr() ; however, unlike other callers of rhtab_delete_elem() , it only uses rcu_read_...

CVE-2026-98787 bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

EUVD-2026-103872

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

CVE-2026-98787 bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

CVE-2026-98785

The Linux kernel contains a vulnerability within the drm/amd/display driver. The function dc_state_create_copy() can return NULL in the event of an allocation failure. If this occurs, dm_suspend() fails to properly abort the suspend process, allowing it to continue and return success while leavin...

CVE-2026-98785 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98786 drm/amd/display: guard dc_sink dereferences in MST mode validation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

EUVD-2026-103871

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98786 drm/amd/display: guard dc_sink dereferences in MST mode validation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...