CVE-2026-98974 xfs: fix exchange-range-to-eof file size exchange

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

CVE-2026-98974

The Linux kernel contains a vulnerability in the XFS filesystem involving the XFS_IOC_EXCHANGE_RANGE operation's TO_EOF flag. The root cause is that the code incorrectly swaps ondisk and incore file sizes when a nonzero offset is used, leading to incorrect file size reporting. This discrepancy ca...

CVE-2026-98974 xfs: fix exchange-range-to-eof file size exchange

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

EUVD-2026-108768

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range-to-eof file size exchange Norbert Szetei posted a patch containing an incomplete description of a bug in XFSIOCEXCHANGERANGE's TOEOF flag. The bug tricks exchange-range into modifying a file so that it has...

CVE-2026-98973

The Linux kernel contains a vulnerability in the drm/bridge component where the drm_bridge_add() function performs an unlocked list_del when re-adding a previously removed bridge. Specifically, the function drops the bridge from bridge_lingering_list without acquiring the bridge_lock . Because br...

CVE-2026-98973 drm/bridge: Fix unlocked list_del in drm_bridge_add()

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked listdel in drmbridgeadd When re-adding a bridge that was previously removed, drmbridgeadd drops it from bridgelingeringlist without holding bridgelock. Both bridgelist and bridgelingeringlist are protecte...

CVE-2026-98973 drm/bridge: Fix unlocked list_del in drm_bridge_add()

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked listdel in drmbridgeadd When re-adding a bridge that was previously removed, drmbridgeadd drops it from bridgelingeringlist without holding bridgelock. Both bridgelist and bridgelingeringlist are protecte...

EUVD-2026-108767

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: Fix unlocked listdel in drmbridgeadd When re-adding a bridge that was previously removed, drmbridgeadd drops it from bridgelingeringlist without holding bridgelock. Both bridgelist and bridgelingeringlist are protecte...

CVE-2026-98972

The Linux kernel contains a vulnerability in the cgroup/cpuset subsystem where the is_in_v2_mode() helper function could potentially access a stale cpuset_cgrp_subsys.root pointer during a cgroup filesystem rebind. This creates a potential Use-After-Free (UaF) situation. To remediate this, a new ...

CVE-2026-98972 cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

EUVD-2026-108766

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

CVE-2026-98972 cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

EUVD-2026-108765

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-98971 gpio: exar: initialize the ID before registering its cleanup

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-98971 gpio: exar: initialize the ID before registering its cleanup

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-98971

The Linux kernel contains a vulnerability in the gpio: exar driver. The root cause is that gpio_exar_probe() stores an allocated ID in exar_gpio only after registering a cleanup action via devm_add_action_or_reset(). If registration fails, the cleanup action is invoked immediately; however, becau...

EUVD-2026-108764

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98970

The Linux kernel contains a memory leak vulnerability within the drm/vc4 component. Specifically, the vc4_bo_cache_destroy() function purges cached Buffer Objects (BOs) but fails to free the size list , resulting in a memory leak every time an unbind occurs. The provided documents do not include ...

CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...