EUVD-2026-87060

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix mismatched free of HalData in rtwsdioif1init padapter-HalData is allocated via vzalloc, but incorrectly freed using kfree in the rtwsdioif1init error path. Using kfree to release this vmalloc-backed buffer...

CVE-2026-98160

The Linux kernel contains a memory corruption vulnerability in the rtl8723bs driver. Specifically, the rtw_sdio_if1_init() function incorrectly uses kfree() to release padapter->HalData, which was originally allocated via vzalloc(). This mismatch in memory deallocation can lead to memory corru...

CVE-2026-98092

The Linux kernel contains a memory leak vulnerability within the ASoC: amd: yc driver. Specifically, the function acp6x_pdm_dma_close() fails to free the runtime->private_data buffer that is initially allocated during acp6x_pdm_dma_open(). This issue is addressed by adding the missing kfree op...

EUVD-2026-86734

In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing qvectors idpf never drains the Tx/Rx DIM works before freeing the memory they live in. txdim and rxdim are embedded in struct idpfqvector, they are queued from the NAPI poll via netdim, and...

kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

A flaw was found in the Linux kernel's crypto: ccp module. An incorrect cleanup usage of the kfree function, which is used for memory deallocation, with a local pointer variable could lead to an invalid deallocation of a stack address. This issue can result in a system crash, causing a Denial of...

kernel: crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree

A flaw was found in the Linux kernel's crypto: ccp module. An incorrect cleanup usage of the kfree function, which is used for memory deallocation, with a local pointer variable could lead to an invalid deallocation of a stack address. This issue can result in a system crash, causing a Denial of...

CVE-2022-42864

CVE-2022-42864: Diabolical Cookies このリポジトリについて これは、CVE-2022-42864（IOHIDFamily の time-of-check-time-of-use 脆弱性で、iOS 16.2 / macOS Ventura 13.1 で修正されました）に対する、私の（不完全な）概念実証エクスプロイトです。 概念実証の現状 現在のエクスプロイトは、multicastbytecopy エクスプロイトで使用されているものと同じ「任意の kfree」プリミティブを実現しています。ただし、multicastbytecopy...

Linux Distros Unpatched Vulnerability : CVE-2026-90104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized...

CVE-2026-93070

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

DEBIAN-CVE-2026-90268

In the Linux kernel, the following vulnerability has been resolved: scsi: sd: Fix error handling in sdprobe after large pool creation failure After deviceadd&sdkp-diskdev succeeds, sdlargepoolcreate failure must unregister diskdev and let scsidiskrelease free sdkp. Going through outfreeindex kfre...

AZL-102090 CVE-2026-90104 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

DEBIAN-CVE-2026-90104

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90104

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

EUVD-2026-82160

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

CVE-2026-92519 riscv, bpf: Fix memory leak in bpf_jit_free

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix memory leak in bpfjitfree When bpfintjitcompile is called for subprograms, it returns early during the first pass !prog-isfunc || extrapass is false, keeping ctx-offset alive for the subsequent extra pass. If JIT...

EUVD-2026-81697

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90104 NFSv4.1: zero referring call lists before decoding

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90104

CVE-2026-90104 affects the Linux kernel's NFSv4.1 callback handling. In decode_cb_sequence_args(), the csa_rclists array is allocated with kmalloc_objs(), leaving referring_call_list entries uninitialized. Because decode_rc_list() only assigns rcl_refcalls when the list is non-empty, a valid empt...

CVE-2026-90104 NFSv4.1: zero referring call lists before decoding

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

DEBIAN-CVE-2026-89992

In the Linux kernel, the following vulnerability has been resolved: cpuidle: dtidlegenpd: kfree the original name allocation dtidlepdalloc kasprintfs the full node path, then points pd-name at kbasename of that string. dtidlepdfree kfrees pd-name, which is no longer the start of the allocation...