EUVD-2026-108806

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Serialize concurrent connect calls isosockconnect checks the socket state before taking the socket lock and drops the lock again before setting up a connection. Two callers can both pass the admission check while...

EUVD-2026-108805

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: serialise scoconn lifetime against scorecvscodata scorecvscodata upgrades the weak hcon-scodata back-pointer to a strong reference under hdev-lock: hcidevlockhdev; hcon = hciconnhashlookuphandlehdev, handle;...

CVE-2026-99011

The Linux kernel is vulnerable to a slab-use-after-free in the Bluetooth SCO subsystem. The issue arises because the sco_recv_scodata() function upgrades a weak back-pointer to a strong reference under hdev->lock, but the pointer is cleared in sco_conn_free() without holding that same lock. Th...

EUVD-2026-108804

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99010

The Linux kernel Bluetooth RFCOMM component contains a memory leak vulnerability. The issue occurs in rfcomm_recv_data() when a Data Link Control (DLC) has no owner (e.g., after rfcomm_sock_destruct() clears d->owner but before the session closes). In the socket implementation, the skb is hand...

CVE-2026-99009

The Linux kernel contains a circular locking dependency vulnerability in the Bluetooth RFCOMM component. The issue arises because an RFCOMM connect() from userspace acquires rfcomm_mutex before hdev->lock, while the HCI event path (via rfcomm_security_cfm()) acquires them in the opposite order...

EUVD-2026-108803

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: connect the session socket without rfcommmutex An RFCOMM connect issued while a BR/EDR link is being authenticated makes lockdep report a circular dependency, and the reported cycle is a real AB/BA between...

EUVD-2026-108802

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...

CVE-2026-99008

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth RFCOMM component. The issue occurs in rfcomm_dev_shutdown() when an RFCOMM tty is closed. Specifically, rfcomm_dev_add() adds a device to the list before registering the tty device; if registration fails, dev->...

EUVD-2026-108801

In the Linux kernel, the following vulnerability has been resolved: drm/fb-helper: defer setup when fbdevprobe fails, not just on -EAGAIN drmfbhelperinitialconfigandunlock calls drmclientmodesetprobe first, which already fills in each modeset-mode/numconnectors for every connected output, and onl...

CVE-2026-99007

The Linux kernel contains a vulnerability in drm/fb-helper where __drm_fb_helper_initial_config_and_unlock() fails to correctly handle errors from drm_fb_helper_single_fb_probe(). When this function fails with any error other than -EAGAIN , the system fails to set fb_helper->deferred_setup, le...

EUVD-2026-108800

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

CVE-2026-99006

A vulnerability exists in the Linux kernel within the drm/i915/gem component. The eb_relocate_parse_slow() function could incorrectly call kvfree() on entries outside the original exec array. This occurs because eb_parse() appends VMAs and increments the eb->buffer_count , but the subsequent c...

EUVD-2026-108799

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gt: Unmask interrupts only when ACTIVE is true There is a small race window between intelrpsboost reading a stale ACTIVE state and queuing rps-work, where ACTIVE may be changed via asynchronous calls triggered by wakeref...

CVE-2026-99005

The Linux kernel (specifically the drm/i915 driver) contains a race condition where rps_work() can be triggered after a Graphics_Technology (GT) unit has been parked. This occurs because of a small window between intel_rps_boost() reading a stale ACTIVE state and queuing the work. If the race con...

EUVD-2026-108798

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99004

The Linux kernel contains a vulnerability in the drm/imagination driver related to how page table preallocation is sized by device address. The root cause involves an incorrect calculation where preallocation was sized from device_addr + sgt_offset with an exclusive end, causing the allocation of...

CVE-2026-99003

The Linux kernel contains a vulnerability in the drm/panthor driver within the panthor_drv.c:panthor_ioctl_group_create() function. The driver incorrectly validates the userspace queue count against a hardcoded maximum (MAX_CS_PER_CSG) instead of the actual number of slots reported by the firmwar...

EUVD-2026-108797

In the Linux kernel, the following vulnerability has been resolved: drm/panthor: validate userspace queue count against initialized firmware slot count In panthordrv.c:panthorioctlgroupcreate, the queue count is validated against the hardcoded maximum: if !args-queues.count || args-queues.count...

EUVD-2026-108796

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: validate pitch coming from userspace Validate the pitch, alongside the box dimensions before trying to copy data from the underlying surface. Fixes possible out of bounds reads with cursor snooping...