EUVD-2026-108888

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98924

A vulnerability in the Linux kernel causes hung tasks when users attempt to unmount a filesystem after its disk has been removed while still in use. The issue occurs because fs_bdev_mark_dead() calls evict_inodes() while holding s_umount . Specifically, whenever evict_inodes() drops s_inode_list_...

CVE-2026-98923

The Linux kernel (arm64 architecture) contains a vulnerability where mapping a stack-top page via /dev/mem with PROT_NONE and subsequently reading /proc//cmdline triggers a spurious WARN in ioremap_prot(). This occurs because generic_access_phys() passes protection from a present-invalid PTE to i...

EUVD-2026-108887

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98923 arm64: io: Reject non-user protection in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98922

The Linux kernel contains a vulnerability in the emac driver causing a NULL pointer dereference during driver initialization. The issue stems from a netdev_need_ops_lock() check in phy_link_topo_add_phy() occurring before netdev_ops were determined. The root cause was triggered by a change in loc...

CVE-2026-98922 net: emac: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

EUVD-2026-108886

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

CVE-2026-98921

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the ovl_do_mkdir() function within the overlay filesystem component. The issue occurs because the function prints the input dentry using %pd after calling vfs_mkdir(). Since a recent change in vfs_mkdir() causes it to call end_crea...

EUVD-2026-108885

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

CVE-2026-98921 ovl: fix UAF in ovl_do_mkdir() debug print

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

EUVD-2026-108884

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folioqueue ENOMEM in writeback by adding a mempool" added a mempool for the folioqueues and made the request, subrequest and folioqueu...

CVE-2026-98920

The Linux kernel contains a vulnerability where direct mempool allocations for folio_queues skipped the alloc_hooks() wrapper. This caused missing alloc tagging when CONFIG_MEM_ALLOC_PROFILING_DEBUG=y is enabled, resulting in kernel warnings during file reads on a CIFS mount and missing data in /...

CVE-2026-98920 netfs: Fix missing alloc tagging of direct mempool allocations

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folioqueue ENOMEM in writeback by adding a mempool" added a mempool for the folioqueues and made the request, subrequest and folioqueu...

CVE-2026-98919

The Linux kernel 's drm/xe component contains a vulnerability in the adjust_idledly() function. The issue stems from multiple corner-case flaws including divide-by-zero errors when timestamp_base is 0, u32 overflows during tick-to-ns conversions, and improper clamping that can cause values to exc...

EUVD-2026-108883

In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjustidledly against divide-by-zero and overflow adjustidledly has several corner-case issues flagged during review: 1. If xegtclockinit failed to recognise the crystal clock, gt-info.timestampbase is 0, which mak...

CVE-2026-98919 drm/xe: harden adjust_idledly() against divide-by-zero and overflow

In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjustidledly against divide-by-zero and overflow adjustidledly has several corner-case issues flagged during review: 1. If xegtclockinit failed to recognise the crystal clock, gt-info.timestampbase is 0, which mak...

CVE-2026-98918

The Linux kernel contains a vulnerability where the DAMON (Deterministic Autorecover Memory Number) subsystem can cause a memory overrun on arm64 architectures. The issue arises in damon_ptep_mkold() because a random byte address, which may be unaligned, is passed to a page table walk. In some ca...

EUVD-2026-108882

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damonptepmkold damonvaprepareaccesscheck picks a random byte address within the region and stores it in r-samplingaddr. damonvamkold passes it into a page table walk, which hands...

CVE-2026-98918 mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damonptepmkold damonvaprepareaccesscheck picks a random byte address within the region and stores it in r-samplingaddr. damonvamkold passes it into a page table walk, which hands...