CVE-2026-64603 platform/x86: intel-hid: Protect ACPI notify handler against recursion

In the Linux kernel, the following vulnerability has been resolved: platform/x86: intel-hid: Protect ACPI notify handler against recursion Since commit e2ffcda16290 "ACPI: OSL: Allow Notify handlers to run on all CPUs" ACPI notify handlers like the intel-hid notifyhandler may run on multiple CPU...

CVE-2026-64603

The CVE-2026-64603 entry describes a race condition in the Linux kernel's intel-hid platform/x86 ACPI notify_handler(). When two ACPI notify events race on different CPUs during lazy registration of the SW_TABLET_MODE input device (triggered from intel_hid_switches_setup()), both can bypass priv-...

CVE-2026-64602

The CVE describes a race condition in spear_adc_probe() for the Linux kernel IIO SPI driver: devm_request_irq() is called before st->completion is initialized, so an IRQ arriving early may call complete() on an uninitialized completion, dereferencing a NULL list entry and causing a kernel pani...

CVE-2026-64602 iio: adc: spear: Initialize completion before requesting IRQ

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "spearadcprobe in drivers/iio/adc/spearadc.c registers its interrupt handler with devmrequestirq before it initializes st-completion...

EUVD-2026-53788

In the Linux kernel, the following vulnerability has been resolved: iio: adc: spear: Initialize completion before requesting IRQ In the report from Jaeyoung Chung: "spearadcprobe in drivers/iio/adc/spearadc.c registers its interrupt handler with devmrequestirq before it initializes st-completion...

EUVD-2026-53787

In the Linux kernel, the following vulnerability has been resolved: ALSA: us144mkii: captureurbcomplete: redundant usbanchorurb corrupts anchor list on each resubmission In captureurbcomplete, usbanchorurb is called on every completion callback, but the URB is already anchored from the initial...

CVE-2026-64601

The CVE-2026-64601 issue affects the Linux kernel ALSA component for the us144mkii driver. In capture_urb_complete(), usb_anchor_urb() is invoked on every completion callback even though the URB was already anchored during initial submission (tascam_trigger_start()). This redundant anchoring corr...

CVE-2026-64597 smb: client: fix double-free in SMB2_close() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2close replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2closeinit fails before the next send, cleanup retains the previous buffer type and fre...

EUVD-2026-53785

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2aeadreqalloc The "numsgs" variable is a u32 so "ERRPTRnumsgs" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler ...

CVE-2026-64598 smb/client: Fix error code in smb2_aead_req_alloc()

In the Linux kernel, the following vulnerability has been resolved: smb/client: Fix error code in smb2aeadreqalloc The "numsgs" variable is a u32 so "ERRPTRnumsgs" doesn't work. We would have to do something similar to the previous line where it's cast to int and then long. However, it's simpler ...

CVE-2026-64597

The CVE-2026-64597 entry concerns a Linux kernel SMB2 client double-free in SMB2_close() replay: a reply-bearing attempt could trigger a replayable error and free the response buffer, with a potential double-free if SMB2_close_init() fails before the next send. The documented fix resets the respo...

CVE-2026-64597 smb: client: fix double-free in SMB2_close() replay

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2close replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2closeinit fails before the next send, cleanup retains the previous buffer type and fre...

CVE-2026-64596

In the Linux kernel, the following vulnerability has been resolved: libfs: set SBINOEXEC and SBINODEV by default in initpseudo Since commit 1e7ab6f67824 "anoninode: rework assertions", pathnoexec warns when an anonymous-inode file is mmap'd from a superblock that has not set SBINOEXEC. dma-buf...

CVE-2026-64596

CVE-2026-64596 affects the Linux kernel’s libfs handling. The vulnerability stemmed from init_pseudo() not setting SB_I_NOEXEC and SB_I_NODEV by default, allowing path_noexec() to warn when anonymous-inode files were mmap’d from certain superblocks. The fix sets both flags by default for every ps...

CVE-2026-64596 libfs: set SB_I_NOEXEC and SB_I_NODEV by default in init_pseudo()

In the Linux kernel, the following vulnerability has been resolved: libfs: set SBINOEXEC and SBINODEV by default in initpseudo Since commit 1e7ab6f67824 "anoninode: rework assertions", pathnoexec warns when an anonymous-inode file is mmap'd from a superblock that has not set SBINOEXEC. dma-buf...

EUVD-2026-53783

In the Linux kernel, the following vulnerability has been resolved: libfs: set SBINOEXEC and SBINODEV by default in initpseudo Since commit 1e7ab6f67824 "anoninode: rework assertions", pathnoexec warns when an anonymous-inode file is mmap'd from a superblock that has not set SBINOEXEC. dma-buf...

EUVD-2026-53782

In the Linux kernel, the following vulnerability has been resolved: HID: hid-lenovo-go: cancel cfgsetup work in hidgocfgremove hidgocfgprobe initialises drvdata.gocfgsetup and schedules it to run 2 ms later: INITDELAYEDWORK&drvdata.gocfgsetup, &cfgsetup; scheduledelayedwork&drvdata.gocfgsetup,...

EUVD-2026-53781

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: initialize resetwork at allocation time ffsfskillsb unconditionally calls cancelworksync on ffs-resetwork when a functionfs instance is unmounted: ffsdataresetffs; cancelworksync&ffs-resetwork; However...

CVE-2026-64593

The CVE-2026-64593 issue affects the Linux kernel Btrfs trim path. A race/drop in device state handling can lead to a NULL device->bdev when re-scanning a previously missing device, causing a NULL pointer dereference during discard trimming (btrfs_trim_fs -> btrfs_trim_free_extents_throttle...

EUVD-2026-53779

In the Linux kernel, the following vulnerability has been resolved: riscv: mm: Unconditionally sfence.vma for spurious fault Svvptc does not guarantee that it's safe to just return here. Since we have already cleared our bit, if, theoretically, the bounded timeframe for the accessed page to becom...