EUVD-2026-108866

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Unwind debug trap enable on copytouser failure If kfddbgtrapenable fails while copying runtimeinfo to userspace, it had already activated the trap, set debugtrapenabled, taken an extra process reference, and opened th...

CVE-2026-98909

A vulnerability exists in the Linux kernel networking stack involving the cpsw_new driver. During the cpsw_probe() process, the driver registers a devlink instance before registering the CPSW ports. If the subsequent cpsw_register_ports() call fails, the error handling path fails to undo the succ...

EUVD-2026-108865

In the Linux kernel, the following vulnerability has been resolved: net: cpswnew: unregister devlink on port registration failure cpswprobe registers devlink before registering the CPSW ports. If cpswregisterports fails, the error path only unregisters the notifiers and then releases the lower...

CVE-2026-98908

The Linux kernel contains a vulnerability in the microchip sparx5 network driver where the sparx5_tc_flower_psfp_setup() function fails to release PSFP resources (stream gate, flow meter, and stream filter) if a subsequent setup step fails. Additionally, a logic error in sparx5_psfp_fm_add() coul...

EUVD-2026-108864

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources...

CVE-2026-98907

The Linux kernel contains a vulnerability within the btrfs filesystem where the sb_write_pointer() function reads the super block from the block device page cache using read_cache_page_gfp(). This operation is susceptible to a race condition with BLKBSZSET , similar to an issue addressed in previ...

EUVD-2026-108863

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

CVE-2026-98906

The Linux kernel contains a vulnerability in the lan966x driver where a failed RX resource reallocation during an MTU change results in an inconsistent state. Specifically, while the driver backs up rx->page_pool and rx->fdma, it fails to restore rx->page_order and rx->max_mtu on fail...

EUVD-2026-108862

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

CVE-2026-98905

The Linux kernel contains a vulnerability in the drm/amdkfd component related to CRIU restore operations. When the function kfd_queue_acquire_buffers() was separated from set_queue_properties_from_user(), the set_queue_properties_from_criu() function was not updated to include the necessary calls...

EUVD-2026-108861

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...

CVE-2014-3153

Towelroot for Ubuntu x86 This exp has been tested on ubuntu 14.04 x86 and ubuntu 12.04.2 x86 successfully. Learning CVE2014-3153 and towelroot. Kernel through version 3.14, use rbtree to store rtwaiternot plistnode, more complex! IA have diffrent threadinfo with ARM!! Source from geekben/towelroo...

CVE-2026-98904

The Linux kernel contains a vulnerability in the mailbox: imx driver related to the premature usage of the device before the probe process is completed. The issue is addressed by switching to devm_pm_runtime_enable() and reordering the initialization sequence. Specifically, the pm_runtime_enable(...

EUVD-2026-108860

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pmruntimeenable into the removal path instead doing it early. This ensure...

CVE-2026-98903

The Linux kernel contains a race condition in the mailbox: imx driver during channel teardown. A timing issue occurs where an RX event remains enabled because it is disabled in imx_mu_shutdown() while the interrupt is active, then re-enabled by imx_mu_isr() while shutdown() waits in free_irq(). T...

EUVD-2026-108859

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

CVE-2026-98902

The Linux kernel contains a vulnerability in the md/raid5 component related to how bm_seq comparisons are handled. The root cause is that once the 32-bit seq wraps, a newer bm_seq might appear smaller than an older one. The issue is resolved by converting the logic to a wrap-safe calculation meth...

EUVD-2026-108858

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

CVE-2026-98901

The Linux kernel 's ksmbd component contained a flaw in lease break and ack state handling . Specifically, the system failed to preserve valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. Additionally, lease break acknowledgments did not consi...

EUVD-2026-108857

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...