CVE-2026-99025 openvswitch: fix soft lockup in the netlink flow dump

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovsflowcmddump calls ovsflowstatsget for eve...

CVE-2026-99025

A vulnerability in the Linux kernel 's openvswitch component causes a soft lockup and system panic during a netlink flow dump . The issue occurs because ovs_flow_cmd_dump() calls ovs_flow_stats_get(), which uses spin_unlock_bh(). This repeatedly enables local softirqs, causing the dumping thread ...

EUVD-2026-108819

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovsflowcmddump calls ovsflowstatsget for eve...

CVE-2026-99024 optee: register TEE devices only once fully initialized

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99024

The Linux kernel contains a vulnerability where optee_probe() calls tee_device_register() for both client and supplicant devices before the struct optee is fully initialized. Because tee_device_register() creates device nodes and links the device into the tee class, the device becomes accessible ...

EUVD-2026-108818

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99024 optee: register TEE devices only once fully initialized

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

EUVD-2026-108817

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023

The Linux kernel contains a memory leak vulnerability in the pcie-m2 power sequencing driver. Specifically, the function of_regulator_bulk_get_all() allocates a consumers array and expects the caller to release it. However, the file pwrseq-pcie-m2.c failed to free this array, resulting in a memor...

EUVD-2026-108816

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

CVE-2026-99022 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

CVE-2026-99022

The Linux kernel contains a vulnerability in the ltc3676 regulator driver where the HRST (0x1e) and CLIRQ (0x1f) registers are incorrectly accessible for reading. Although these are write-only command strobes—where HRST triggers a hard reset and CLIRQ clears an interrupt—performing a read operati...

CVE-2026-99022 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

CVE-2026-99021 regulator: of: fill in supply names in of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

EUVD-2026-108815

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

CVE-2026-99021

The Linux kernel contains a vulnerability in the of_regulator_bulk_get_all() function. The function allocates an array but fails to populate the supply names for each entry, whereas the core logic expects these names to be present. Specifically, regulator_bulk_enable() may attempt to print these ...

CVE-2026-99021 regulator: of: fill in supply names in of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...

CVE-2026-99020 regulator: tps6594-regulator: Fix n_linear_ranges for TPS65224 BUCK2-4

In the Linux kernel, the following vulnerability has been resolved: regulator: tps6594-regulator: Fix nlinearranges for TPS65224 BUCK2-4 The TPS65224 BUCK2, BUCK3 and BUCK4 descriptors pass 4 as nlinearranges, but tps65224bucks234ranges only has two entries, covering selectors 0x00-0x45. The line...