CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

CVE-2026-99207

The Linux kernel contains a vulnerability where target_do_delayed_work() acquires the dev->delayed_cmd_lock using a plain spin_lock() while running in system_percpu_wq. Because interrupts remain enabled while this lock is held, it conflicts with other functions—such as target_handle_task_attr(...

EUVD-2026-111959

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

CVE-2026-99207 scsi: target: Disable interrupts while holding delayed_cmd_lock

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Disable interrupts while holding delayedcmdlock targetdodelayedwork takes dev-delayedcmdlock with a plain spinlock. It runs from systempercpuwq, so interrupts stay enabled while the lock is held. Every other...

CVE-2026-99206 scsi: target: iscsi: Fix race in discovery auth updates

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsiupdateparamvalue, causing a double-free...

EUVD-2026-111958

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsiupdateparamvalue, causing a double-free...

CVE-2026-99205 sched/core: Call wakeup_preempt() for queued tasks during class change

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99205 sched/core: Call wakeup_preempt() for queued tasks during class change

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99206 scsi: target: iscsi: Fix race in discovery auth updates

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix race in discovery auth updates Separate configfs opens can concurrently update the discovery AuthMethod parameter. Both callers may free the same value in iscsiupdateparamvalue, causing a double-free...

CVE-2026-99205

The Linux kernel is affected by a race condition in sched/core where a CPU may idle despite having a runnable task. The issue occurs when a task is enqueued and subsequently undergoes a class change via __sched_setscheduler() for queued, non-running tasks. Specifically, the rq->next_class indi...

CVE-2026-99206

A double-free vulnerability exists in the Linux kernel within the scsi: target: iscsi component. The issue is caused by a race condition where separate configfs opens can concurrently update the discovery AuthMethod parameter. This concurrency allows both callers to free the same value within the...

EUVD-2026-111957

In the Linux kernel, the following vulnerability has been resolved: sched/core: Call wakeuppreempt for queued tasks during class change Paul reported recent RCU changes exposed a lost resched where CPU idles with a rcutorture thread waiting while being completely runnable. Dumping the rq state at...

CVE-2026-99204 ocfs2/dlm: Protect the recovery list during debugfs reads

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

CVE-2026-99204

The Linux kernel contains a use-after-free vulnerability within the ocfs2/dlm module. The issue occurs because debug_state_print() traverses and formats recovery participant records while holding dlm->spinlock, but these records are actually protected by dlm_reco_state_lock. This allows a conc...

CVE-2026-99204 ocfs2/dlm: Protect the recovery list during debugfs reads

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

EUVD-2026-111956

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: Protect the recovery list during debugfs reads Recovery participant records must remain alive while debugstateprint walks reco.nodedata and formats their fields. The formatter holds dlm-spinlock, but the recovery...

CVE-2026-99203

A flaw in the Linux kernel pipe subsystem allows an unprivileged, local attacker to trigger a KASAN slab-use-after-free vulnerability under memory pressure. The issue stems from improper error handling during asynchronous I/O (fasync) notification setup; specifically, when a writer setup fails, t...

CVE-2026-99203 pipe: preserve existing fasync readers on writer setup failure

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

EUVD-2026-111955

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...