CVE-2026-99240

The Linux kernel contains a vulnerability in the DAMON (Data Access Monitor) subsystem where a zero damos_quota_goal target value can trigger a division-by-zero error. To resolve this, the handling was moved to the core layer. The fix involves adding a check in damos_commit_quota_goal() to valida...

CVE-2026-99240 mm/damon/core: error damos_commit_quota_goal() for zero target_value

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damoscommitquotagoal for zero targetvalue Patch series "mm/damon: move zero damos quota targetvalue handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...

EUVD-2026-115281

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...

CVE-2026-99240 mm/damon/core: error damos_commit_quota_goal() for zero target_value

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damoscommitquotagoal for zero targetvalue Patch series "mm/damon: move zero damos quota targetvalue handling to the core layer". Having zero DAMOS quota target value can cause division by zero. DAMON API...

CVE-2026-99239 Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...

CVE-2026-99239

A TOCTOU race condition in the Linux kernel Bluetooth L2CAP component allows the l2cap_chan to be linked to l2cap_conn more than once, violating internal invariants. This occurs because l2cap_sock_connect() fails to check sk->sk_state, and l2cap_sock_bind() lacks sufficient locking for chan-&g...

CVE-2026-99239 Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse l2capchanadd if chan already has conn l2capchan may be linked to l2capconn at most once. This is assumed in several places, eg l2capchandel cleanup. There is a TOCTOU race where the invariant is violated:...

EUVD-2026-115279

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when resetting last boot data from readers updatelastdataifempty is called from tracingopen with OTRUNC, tracingreadpipe and tracingbuffersread without tracetypeslock. Two readers can both pass the...

CVE-2026-99237

The Linux kernel is affected by a vulnerability in its tracing subsystem. Specifically, the function update_last_data_if_empty() is called by tracing_open() (with O_TRUNC), tracing_read_pipe(), and tracing_buffers_read() without acquiring the trace_types_lock . This lack of locking allows two rea...

CVE-2026-99238 tracing: Hold trace_types_lock when updating modules in persistent instances

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...

CVE-2026-99238

A vulnerability exists in the Linux kernel tracing subsystem where trace_module_record() walks ftrace_trace_arrays from the module notifier without holding the trace_types_lock . If a concurrent rmdir of an instance occurs, it removes and frees the array under that lock, potentially causing a mod...

CVE-2026-99238 tracing: Hold trace_types_lock when updating modules in persistent instances

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...

CVE-2026-99237 tracing: Hold trace_types_lock when resetting last boot data from readers

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when resetting last boot data from readers updatelastdataifempty is called from tracingopen with OTRUNC, tracingreadpipe and tracingbuffersread without tracetypeslock. Two readers can both pass the...

CVE-2026-99237 tracing: Hold trace_types_lock when resetting last boot data from readers

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when resetting last boot data from readers updatelastdataifempty is called from tracingopen with OTRUNC, tracingreadpipe and tracingbuffersread without tracetypeslock. Two readers can both pass the...

EUVD-2026-115280

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold tracetypeslock when updating modules in persistent instances tracemodulerecord walks ftracetracearrays from the module notifier without tracetypeslock. A concurrent rmdir of an instance removes it from the list and...

CVE-2026-99235 tracing: Save the event file instead of the compatible histogram

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

CVE-2026-99234 tracing: Unregister field variable histograms when the command fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

EUVD-2026-115276

In the Linux kernel, the following vulnerability has been resolved: tracing: Unregister field variable histograms when the command fails An action that names a field on another event needs that field as a variable, so createfieldvarhist registers a second hist trigger on that event to provide it,...

CVE-2026-99235 tracing: Save the event file instead of the compatible histogram

In the Linux kernel, the following vulnerability has been resolved: tracing: Save the event file instead of the compatible histogram createfieldvarhist creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: histdata =...

CVE-2026-99236

The Linux kernel contains a vulnerability in the tracing subsystem where incomplete event filter expressions are not properly rejected. Specifically, if an input ends after an operator (e.g., &&) or a unary ! token, the predicate_parse() function's outer loop falls through with an unresolved oper...