EUVD-2026-111919

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-99166 net: rds: fix uninitialized trans dereference in CM event handler

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix uninitialized trans dereference in CM event handler rdsrdmacmeventhandlercmn assigns trans only when the RDMA device is an InfiniBand CA RDMANODEIBCA. On any other device type, e.g. an iWARP RNIC such as siw, trans...

CVE-2026-99167 net/sched: fix use-after-free in __tcf_action_put()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99167 net/sched: fix use-after-free in __tcf_action_put()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix use-after-free in tcfactionput tcfactionput decrements the reference count before decrementing the binding count. Another thread can free the action between these operations, causing the binding-count update to...

CVE-2026-99165 sctp: revalidate output stream after association connect wait

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

EUVD-2026-111917

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

CVE-2026-99165 sctp: revalidate output stream after association connect wait

In the Linux kernel, the following vulnerability has been resolved: sctp: revalidate output stream after association connect wait When message interleaving is enabled, the first send waits for association establishment before building its data chunks. The wait drops the socket lock, and handshake...

CVE-2026-99165

The Linux kernel contains a vulnerability in the SCTP implementation when message interleaving is enabled. During an association connect wait, the kernel drops the socket lock, allowing handshake processing to reduce the output stream count and free stream extensions. The sender may resume with a...

CVE-2026-99164 spi: imx: fix slab corruption from undersized DMA bounce buffers

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

CVE-2026-99164

The Linux kernel contains a vulnerability in the spi: imx driver where private DMA TX/RX buffers are allocated with kzalloc(dma_len), rounding dma_len only to 4 bytes. However, the driver maps, syncs, and unmaps these buffers using DMA_CACHE_ALIGNED_LEN(dma_len), which rounds to the cache line si...

CVE-2026-99164 spi: imx: fix slab corruption from undersized DMA bounce buffers

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

EUVD-2026-111916

In the Linux kernel, the following vulnerability has been resolved: spi: imx: fix slab corruption from undersized DMA bounce buffers Since commit faa8e404ad8e "spi: imx: support dynamic burst length for ECSPI DMA mode", the driver allocates its private DMA TX/RX buffers with kzallocdmalen, where...

CVE-2026-99163 tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

EUVD-2026-111915

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

CVE-2026-99163 tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields

In the Linux kernel, the following vulnerability has been resolved: tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields In checksynthfield, when a synthetic event field is a stacktrace field-isstack and the histogram field is not a "long" stacktrace array, validation...

CVE-2026-99163

The Linux kernel contains a vulnerability in the tracing/histograms component where synthetic event fields marked as stacktraces (field->is_stack) lack proper validation if the histogram field is not a long[ stacktrace array. Due to how parse_synth_field() handles types, any 8-byte signed scal...

CVE-2026-99162 gpio: shared: fix use-after-free bug when adding shared proxies

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

EUVD-2026-111914

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...

CVE-2026-99162 gpio: shared: fix use-after-free bug when adding shared proxies

In the Linux kernel, the following vulnerability has been resolved: gpio: shared: fix use-after-free bug when adding shared proxies The GPIO lookup table can stay alive for longer than the kobject whose name string's address we're assigning to lookup-devid. Fix a potential UAF by duplicating the...