CVE-2026-99182

The Linux kernel contains a vulnerability in the ASoC: SOF: ipc4-topology component during aggregated ALH capture . When the number of channels (ch_count ) is smaller than the device count, the calculation for step truncates to 0, causing an underflow in GENMASK(step - 1, 0) . This results in a s...

CVE-2026-99182 ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

CVE-2026-99182 ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

EUVD-2026-111934

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture When chcount is smaller than blob-alhcfg.devicecount e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links, step = chcoun...

CVE-2026-99181

The Linux kernel contains a vulnerability in the autofs component where autofs_notify_daemon() fails to properly handle notification errors from a replaced pipe. Specifically, a delayed write could return -EPIPE if the old pipe's reader is closed while the daemon is in catatonic mode, causing the...

CVE-2026-99181 autofs: ignore notification errors from a replaced pipe

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

EUVD-2026-111933

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

CVE-2026-99181 autofs: ignore notification errors from a replaced pipe

In the Linux kernel, the following vulnerability has been resolved: autofs: ignore notification errors from a replaced pipe autofsnotifydaemon takes a reference to the current notification pipe under wqmutex, then drops the mutex before writing the request. The write can block while the daemon...

EUVD-2026-111932

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99180

A use-after-free vulnerability exists in the Linux kernel because generic_ci_d_hash() and generic_ci_d_compare() can dereference a unicode map while a pathwalk in RCU mode holds only rcu_read_lock(). The issue affects filesystems including ext4 , f2fs , and tmpfs , where the map is dropped via ut...

CVE-2026-99180 unicode: free the map after a grace period

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99180 unicode: free the map after a grace period

In the Linux kernel, the following vulnerability has been resolved: unicode: free the map after a grace period genericcidhash and genericcidcompare read sb-sencoding and dereference the unicode map while a pathwalk in rcu mode holds nothing but rcureadlock. The filesystems that use them, ext4, f2...

CVE-2026-99179 watch_queue: Fix note pool publication race in watch_queue_set_size()

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

CVE-2026-99179 watch_queue: Fix note pool publication race in watch_queue_set_size()

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

EUVD-2026-111931

In the Linux kernel, the following vulnerability has been resolved: watchqueue: Fix note pool publication race in watchqueuesetsize There is a race between watchqueuesetsize and postonenotification. watchqueuesetsize publishes wqueue-notes, notesbitmap, nrpages and nrnotes with plain stores, and...

CVE-2026-99179

The Linux kernel is vulnerable to a race condition in watch_queue_set_size() and post_one_notification(). Because watch_queue_set_size() uses plain stores to publish wqueue->notes, notes_bitmap, nr_pages, and nr_notes, there is no ordering guarantee. This allows post_one_notification() to read...

CVE-2026-99178 x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...

EUVD-2026-111929

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99177 KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

EUVD-2026-111930

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...