CVE-2026-99020 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix nlinearranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as nlinearranges, but tps65224bucks234ranges only has two entries, covering selectors 0x00-0x45. The line...

CVE-2026-99020

The Linux kernel contains a memory safety issue within the tps6594-regulator driver. Specifically, the TPS65224 BUCK2, BUCK3, and BUCK4 descriptors incorrectly report 4 as the number of linear ranges, while the underlying tps65224_bucks_2_3_4_ranges[] array only contains two entries. This discrep...

CVE-2026-99019 scsi: ch: Do not keep references to data transfer element devices

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

CVE-2026-99019

The Linux kernel contains a vulnerability in the scsi changer (ch) component where the ch_readconfig() function incorrectly maintains references to data transfer element devices . Because scsi_device_lookup() takes a reference that is never dropped, removed drives remain on the host's device list...

CVE-2026-99019 scsi: ch: Do not keep references to data transfer element devices

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

EUVD-2026-108813

In the Linux kernel, the following vulnerability has been resolved: scsi: ch: Do not keep references to data transfer element devices chreadconfig looks up the scsidevice of every data transfer element whose SCSI id the changer reports in READ ELEMENT STATUS, and stores it in ch-dt...

CVE-2026-99018

The Linux kernel contains a vulnerability under CONFIG_SHADOW_CALL_STACK where the handle_exception() function incorrectly uses the user-writable tp register to determine if a trap originated from userspace. An unprivileged user can manipulate tp to bypass the shadow call stack reload, causing th...

CVE-2026-99018 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

EUVD-2026-108812

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

CVE-2026-99018 riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp

In the Linux kernel, the following vulnerability has been resolved: riscv: entry: gate shadow call stack reload on sstatus.SPP, not tp Under CONFIGSHADOWCALLSTACK, handleexception reloads the kernel shadow call stack pointer gp only when the trap came from userspace. It made that decision with...

EUVD-2026-108811

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

CVE-2026-99017 riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

CVE-2026-99017 riscv: errata: select RISCV_ALTERNATIVE_EARLY for THEAD GHOSTWRITE

In the Linux kernel, the following vulnerability has been resolved: riscv: errata: select RISCVALTERNATIVEEARLY for THEAD GHOSTWRITE errataprobeghostwrite only marks the CPU as vulnerable when it is called at the RISCVALTERNATIVESEARLYBOOT stage, and the mitigation in ghostwriteenablemitigation...

CVE-2026-99017

The Linux kernel contains a vulnerability where the T-Head C9xx CPU might not have its ghostwrite mitigation applied correctly. The root cause is that errata_probe_ghostwrite() only marks the CPU as vulnerable during the RISCV_ALTERNATIVES_EARLY_BOOT stage. In kernels where ERRATA_THEAD_GHOSTWRIT...

CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

EUVD-2026-108810

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

CVE-2026-99016

The Linux kernel contains a vulnerability in the RISC-V architecture's futex implementation. When the tagged address ABI is enabled (CONFIG_RISCV_ISA_SUPM , PMLEN != 0 ), the access_ok() function checks an untagged address, but arch_futex_atomic_op_inuser() and futex_atomic_cmpxchg_inatomic() pas...

CVE-2026-99015

The Linux kernel contains a race condition in the Bluetooth hci_sock component where rebinding an HCI socket after a controller is unregistered can crash the kernel. The root cause is a lack of proper serialization: hci_sock_bind() clears the device reference under only the socket lock, while sen...

EUVD-2026-108809

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...