CVE-2026-98319 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmpendingvblankevent leak in error path for outfenceptr When an outfenceptr is provided but DRMMODEPAGEFLIPEVENT is not set, a drmpendingvblankevent will be allocated. If later, there is an allocation failure or another...

CVE-2026-98319

The Linux kernel contains a memory leak vulnerability in the DRM (Direct Rendering Manager) subsystem. When an out_fence_ptr is provided without the DRM_MODE_PAGE_FLIP_EVENT flag set, a drm_pending_vblank_event is allocated. If a subsequent failure occurs during setup_out_fence() , the event fail...

EUVD-2026-93304

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmpendingvblankevent leak in error path for outfenceptr When an outfenceptr is provided but DRMMODEPAGEFLIPEVENT is not set, a drmpendingvblankevent will be allocated. If later, there is an allocation failure or another...

CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98317 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

CVE-2026-98317 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

EUVD-2026-93302

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

CVE-2026-98317

The Linux kernel contains a vulnerability in the neighbour component where the NDTPA_INTERVAL_PROBE_TIME_MS parameter lacks proper validation. Specifically, the lack of a .validation_type allowed values like 0 to be accepted. Additionally, a u64 to u32 silent cast in nla_get_msecs() allowed large...

EUVD-2026-93301

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98316

The Linux kernel contains a race condition in the ALSA: bcd2000 driver. During a USB disconnect, a Use-After-Free (UAF) vulnerability can occur because the rawmidi trigger callback might still access a URB (USB Request Block) while the driver handles the disconnect. The root cause is that the pre...

CVE-2026-98316 ALSA: bcd2000: Fix race between rawmidi and disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98316 ALSA: bcd2000: Fix race between rawmidi and disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98315

The Linux kernel contains a vulnerability in the ntfs filesystem driver where ntfs_non_resident_attr_shrink() fails to hold the runlist write lock while freeing clusters and truncating the runlist. This lack of synchronization can lead to race conditions during runlist updates. Additionally, ntfs...

CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

EUVD-2026-93300

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

EUVD-2026-93298

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...