CVE-2026-99188

The Linux kernel contains a vulnerability in the stmmac driver for the dwmac1000 controller. Due to the removal of certain interrupt handling in a previous commit, the GMAC_RGSMIIIS status remains pending behind the GMAC_INT_MASK after a link change. When stmmac_resume() resets the MAC, the mask ...

CVE-2026-99187

The Linux kernel contains a vulnerability in the perf subsystem where __perf_pmu_remove() prematurely ends its walk of group leaders because perf_remove_from_context() removes the leader from the rbtree, causing rb_next() to return NULL. This results in some groups remaining in the source context...

EUVD-2026-111939

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99186 x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

CVE-2026-99186

The Linux kernel contains a vulnerability in the x86/insn-eval component caused by a shadowed segment index in the get_seg_reg_override_idx() function. A change in the for_each_insn_prefix() macro introduced a local loop counter named idx, which conflicts with a local variable of the same name in...

CVE-2026-99187 perf: Fix perf_pmu_migrate_context() leaving events behind

In the Linux kernel, the following vulnerability has been resolved: perf: Fix perfpmumigratecontext leaving events behind perfpmuremove walks the group leaders of a CPU and PMU with perfeventgroupsforcpupmu, removing each one as it goes. perfremovefromcontext takes the leader out of the groups...

CVE-2026-99186 x86/insn-eval: Fix shadowed segment index in get_seg_reg_override_idx()

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

EUVD-2026-111938

In the Linux kernel, the following vulnerability has been resolved: x86/insn-eval: Fix shadowed segment index in getsegregoverrideidx Commit 45e1dccc0653 "x86/insn: Simplify foreachinsnprefix" made foreachinsnprefix declare its own loop counter named idx. getsegregoverrideidx keeps its result in ...

CVE-2026-99185

The Linux kernel contains a race condition in the firewire core split transaction handling. Specifically, both fw_core_handle_response() and split_transaction_timeout_callback() could concurrently manipulate the same transaction entry in the pending transaction list if timer_delete() returns zero...

EUVD-2026-111937

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fwcorehandleresponse or splittransactiontimeoutcallback may manipulate the same transaction entry in the pending transaction list. T...

CVE-2026-99185 firewire: core: fix race condition in split transaction handling

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fwcorehandleresponse or splittransactiontimeoutcallback may manipulate the same transaction entry in the pending transaction list. T...

CVE-2026-99185 firewire: core: fix race condition in split transaction handling

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix race condition in split transaction handling For a split transaction, either fwcorehandleresponse or splittransactiontimeoutcallback may manipulate the same transaction entry in the pending transaction list. T...

EUVD-2026-111936

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

CVE-2026-99184

The Linux kernel contains a vulnerability in the accel/rocket driver where unbinding cores in the order they were bound leads to an out-of-bounds write . This occurs because rocket_remove() decrements rdev->num_cores, while find_core_for_dev() searches only up to num_cores - 1. Consequently, t...

CVE-2026-99184 accel/rocket: search every core slot when a core is removed

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

CVE-2026-99184 accel/rocket: search every core slot when a core is removed

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when a core is removed rocketremove decrements rdev-numcores for each core it removes, while findcorefordev searches slots 0 to numcores - 1. Unbinding the cores in the order they were bound...

CVE-2026-99183

The Linux kernel contains a vulnerability in the accel/rocket driver where the sched_to_core() function incorrectly returns NULL when a core is unbound if it is not the last core in the sequence. This occurs because rocket_remove() decrements num_cores, causing subsequent cores to fall outside th...

CVE-2026-99183 accel/rocket: search every core slot when looking up a scheduler

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

CVE-2026-99183 accel/rocket: search every core slot when looking up a scheduler

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...

EUVD-2026-111935

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: search every core slot when looking up a scheduler schedtocore walks rdev-cores up to rdev-numcores, and rocketremove decrements numcores for every core it removes. Unbind a core that is not the last one and the cor...