CVE-2026-64432

Summary: CVE-2026-64432 affects the Linux kernel, specifically the ntfs3 filesystem code path used during NTFS image replay. The issue stems from validating the Dirty Page Table (DPT) capacity in log_replay() when copying LCNs; if dp->lcns_follow (capacity) is smaller than lrh->lcns_follow,...

CVE-2026-64431

Summary of CVE-2026-64431 (Linux kernel NTFS driver): A memory corruption vulnerability arises when post_write_mst_fixup() is called for an invalid index_block after ntfs_ib_write() returns an error. The root cause is that ntfs_icx_ib_sync_write() treated any error as a write failure and invoked ...

CVE-2026-64431 ntfs: avoid calling post_write_mst_fixup() for invalid index_block

In the Linux kernel, the following vulnerability has been resolved: ntfs: avoid calling postwritemstfixup for invalid indexblock ntfsicxibsyncwrite calls postwritemstfixup when ntfsibwrite returns an error, intending to restore the buffer after a failed write. However, ntfsibwrite returns an erro...

CVE-2026-64432 fs/ntfs3: validate Dirty Page Table capacity in log_replay copy_lcns

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate Dirty Page Table capacity in logreplay copylcns In the analysis pass of $LogFile journal replay, logreplay copies LCNs from each action log record into an existing Dirty Page Table DPT entry without bounding th...

CVE-2026-64430 NTB: epf: Avoid calling pci_irq_vector() from hardirq context

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pciirqvector from hardirq context ntbepfvecisr calls pciirqvector in hardirq context to derive the vector number. pciirqvector calls msigetvirq that takes a mutex and can therefore trigger "scheduling whil...

CVE-2026-64430

CVE-2026-64430 affects the Linux kernel NTB EPF subsystem. ntb_epf_vec_isr previously called pci_irq_vector() in hardirq context, and pci_irq_vector() may call msi_get_virq() which takes a mutex and can trigger scheduling while atomic. The fix caches the Linux IRQ number for vector 0 when vectors...

CVE-2026-64429

CVE-2026-64429 : In the Linux kernel, the gpio eic-sprd driver used a sleeping lock during irq startup (spin_lock_irqsave) which could be invoked from an irq_startup path, leading to a sleeping function in an invalid context on PREEMPT_RT. The fix converts the Spreadtrum EIC controller lock to a ...

EUVD-2026-48774

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pciirqvector from hardirq context ntbepfvecisr calls pciirqvector in hardirq context to derive the vector number. pciirqvector calls msigetvirq that takes a mutex and can therefore trigger "scheduling whil...

EUVD-2026-48773

In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use rawspinlockt in the irq startup path sprdeicirqunmask enables the GPIO IRQ and then updates controller state through sprdeicupdate, which takes sprdeic-lock with spinlockirqsave. The callback can be reached fr...

EUVD-2026-48772

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

CVE-2026-64428

In CVE-2026-64428, a Linux kernel vulnerability was fixed in the GPIO SCH irq path. The issue arose because sch_irq_unmask() enables the GPIO IRQ and then updates controller state via sch_irq_mask_unmask(), which uses sch->lock with spin_lock_irqsave(). The callback could reach irq_startup() w...

CVE-2026-64428 gpio: sch: use raw_spinlock_t in the irq startup path

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

CVE-2026-64428 gpio: sch: use raw_spinlock_t in the irq startup path

In the Linux kernel, the following vulnerability has been resolved: gpio: sch: use rawspinlockt in the irq startup path schirqunmask enables the GPIO IRQ and then updates the controller state through schirqmaskunmask, which takes sch-lock with spinlockirqsave. The callback can be reached from...

EUVD-2026-48771

In the Linux kernel, the following vulnerability has been resolved: HID: logitech-dj: Fix maxfield check in DJ short report validation Commit b6a57912854e "HID: logitech-dj: Prevent REPORTIDDJSHORT related user initiated OOB write" added validation for the DJ short output report, but the error pa...

CVE-2026-64427

Consolidated data for CVE-2026-64427 shows a resolved Linux kernel HID issue in the Logitech DJ driver. Root cause: the DJ short report validation could dereference rep->field[0] when rep->maxfield was zero, even after a prior fix, due to a crafted descriptor that creates a 0x20 report with...

CVE-2026-64426

Summary (CVE-2026-64426) Multiple sources describe a Linux kernel vulnerability in io_uring/nop where a file reference leak occurs when IOSQE_FIXED_FILE is set but IORING_NOP_FIXED_FILE is not; if REQ_F_FIXED_FILE is set, io_nop() may take the normal path and grab a real reference via io_file_get...

EUVD-2026-48769

In the Linux kernel, the following vulnerability has been resolved: iouring/io-wq: re-check IOWQBITEXIT for each linked work item commit 10dc95939817 "iouring/io-wq: check IOWQBITEXIT inside work run loop" fixed the obvious case where ioworkerhandlework took one exit-bit snapshot before draining...

CVE-2026-64425

CVE-2026-64425 affects the Linux kernel io_uring/io-wq component. The vulnerability arises from where io_worker_handle_work() snapshots IO_WQ_BIT_EXIT and only later re-checks it inside the outer work loop, allowing linked work items to run after exit has begun if IO_WQ_BIT_EXIT is set post-start...

EUVD-2026-48967

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...