CVE-2026-99178

The Linux kernel contains a vulnerability in x86/kvm where an async #PF (page not present) event can cause a kernel panic during an NMI context . The issue occurs because if an NMI arrives after an async #PF is injected but before the handler reads the apf_reason.flags, the NMI handler's own page...

CVE-2026-99177 KVM: SEV: Fix page dirtying in sev_gmem_post_populate()

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Fix page dirtying in sevgmempostpopulate setpagedirty requires that the caller holds some kind of lock to ensure that the page's mapping does not concurrently go away. That is not the case for a random page we got from...

CVE-2026-99177

The Linux kernel contains a vulnerability in the KVM: SEV component related to how page dirtying is handled in sev_gmem_post_populate() . The issue stems from the fact that set_page_dirty() requires the caller to hold a lock to prevent a page's mapping from disappearing concurrently; however, thi...

CVE-2026-99178 x86/kvm: Don't consume async #PF flags on a kernel #PF in NMI context

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Don't consume async PF flags on a kernel PF in NMI context An async PF "page not present" event arrives through the PF vector, and its reason sits in the per-CPU apfreason.flags until kvmhandleasyncpf reads and clears it...

EUVD-2026-111928

In the Linux kernel, the following vulnerability has been resolved: KVM: nVMX: Reset MMU back to the root MMU if loading L2 state fails for !VM-Entry Reset the vCPU's MMU pointer back to the root MMU if loading L2 state fails in the "not from VM-Entry" case, i.e. when emulating RSM or handling...

CVE-2026-99175

The Linux kernel contains a vulnerability in the fsnotify subsystem where a race condition occurs during connector teardown. Specifically, fsnotify_destroy_marks() fails to prevent new marks from being inserted while it drops conn->lock. This allows a replacement mark to be inserted, causing t...

CVE-2026-99175 fsnotify: prevent mark additions during connector teardown

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...

CVE-2026-99175 fsnotify: prevent mark additions during connector teardown

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...

EUVD-2026-111927

In the Linux kernel, the following vulnerability has been resolved: fsnotify: prevent mark additions during connector teardown fsnotifydestroymarks keeps a reference to its current mark while it drops conn-lock to destroy the mark. This stabilizes the forward-walk cursor, but does not prevent a n...

CVE-2026-99173 eventfs: Free the eventfs_inode after an rcu grace period too

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99174 ext4: free the sbi after a grace period

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...

CVE-2026-99173 eventfs: Free the eventfs_inode after an rcu grace period too

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

CVE-2026-99174

The Linux kernel contains a vulnerability in the ext4 filesystem where ext4_put_super() destroys percpu counters, clears sb->s_fs_info, and frees the sbi without waiting for a required grace period. This occurs when a pathwalk is held up in ext4_get_link() while the last reference to the mount...

CVE-2026-99174 ext4: free the sbi after a grace period

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...

CVE-2026-99173

A flaw in the Linux kernel's eventfs subsystem allows for a use-after-free condition. The tracefs_d_revalidate() function reads the is_freed status of an eventfs_inode while holding only an rcu_read_lock(). Because the eventfs_srcu grace period does not account for rcu_read_lock() sections, the i...

EUVD-2026-111925

In the Linux kernel, the following vulnerability has been resolved: eventfs: Free the eventfsinode after an rcu grace period too tracefsdrevalidate reads -isfreed of the eventfsinode that dentry-dfsdata points to, and -drevalidate is called in rcu pathwalk mode with nothing but rcureadlock held...

EUVD-2026-111926

In the Linux kernel, the following vulnerability has been resolved: ext4: free the sbi after a grace period ext4getlink follows a symlink that keeps its target in a data block in rcu pathwalk mode with ext4getblkEXT4GETBLOCKSCACHEDNOWAIT. That reads smountstate in the ASSERT of ext4getblk and aga...

CVE-2026-99172 ipc: drop the mqueue mount with kern_unmount() on setup failure

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...

CVE-2026-99172

The Linux kernel contains a memory leak vulnerability where mqueue mounts and mqueue superblocks are leaked during setup failures. The issue occurs because mq_init_ns() creates a mount with fc_mount_longterm(), but subsequent failures in create_ipc_ns() (during mqueue, ipc sysctls, or msg_init_ns...

CVE-2026-99172 ipc: drop the mqueue mount with kern_unmount() on setup failure

In the Linux kernel, the following vulnerability has been resolved: ipc: drop the mqueue mount with kernunmount on setup failure mqinitns creates the mqueue mount with fcmountlongterm, so its -mntns is MNTNSINTERNAL. When setting up the mqueue or ipc sysctls or msginitns fails afterwards,...