EUVD-2026-93107

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix rmmio iounmap skipped on device removal amdgpupciremove calls drmdevunplug before finisw, so drmdeventer is already false there and the iounmap guarded by it is skipped. This .remove path runs on both hot-unplug a...

CVE-2026-98179

A vulnerability in the Linux kernel 's drm/amdgpu driver causes a memory leak during device removal. Specifically, the amdgpu_pci_remove() function calls drm_dev_unplug() before fini_sw(), resulting in drm_dev_enter() being false. This causes the iounmap() call, which is guarded by that check, to...

CVE-2026-98178

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the function amdgpu_amdkfd_clear_kfd_mapping() incorrectly assumes a non-NULL kfd_dev has a fully populated node array. This issue occurs when KFD device initialization fails after the probe phase, specifically on Polaris sy...

EUVD-2026-93106

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpuamdkfdclearkfdmapping assumes that a non-NULL kfddev has a fully populated node array. This is not true when KFD device initialization fails after probe. For example,...

CVE-2026-98177

The Linux kernel contains an integer underflow vulnerability within the drm/amdkfd component during the EOP ring size calculation . The issue stems from calculating the base-2 logarithm using order_base_2(q->eop_ring_buffer_size / 4) - 1, where order_base_2 could theoretically return 0, causin...

EUVD-2026-93104

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow with ffs in EOP ring size calc The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as ffsq-eopringbuffersize / sizeofunsigned int - 1 - 1 But...

CVE-2026-98176

The Linux kernel contains an integer underflow vulnerability in the drm/amdkfd component. The issue occurs because the base-2 logarithm of the EOP ring size was calculated using a formula that could underflow if the ffs function returned 1 or 0. While the ring buffer size is practically restricte...

EUVD-2026-93105

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Avoid integer underflow in EOP ring size calculation. The low 6 bits of cphqdeopcontrol store the base-2 logarithm of the EOP ring size. This was calculated as orderbase2q-eopringbuffersize / 4 - 1 But orderbase2 can ...

CVE-2026-98175

A use-after-free vulnerability exists in the Linux kernel 's SMB client. The issue occurs because clean_demultiplex_info() cancels server->echo delayed work but fails to cancel server->reconnect work before calling kfree_sensitive(server). This can lead to a use-after-free read of server-&g...

EUVD-2026-93103

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

EUVD-2026-93102

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix rlist race and missing initialization TCPServerInfo.rlist is allocated via kzalloc which zeros both -next and -prev to NULL instead of pointing to itself, making listempty always return false and listadd...

CVE-2026-98174

The Linux kernel contains a vulnerability in the SMB client related to the TCP_Server_Info.rlist structure. The issue stems from using kzalloc, which incorrectly initializes ->next and ->prev pointers to NULL instead of pointing to the structure itself, causing list_empty() to return false ...

EUVD-2026-93101

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173

The Linux kernel contains a use-after-free vulnerability in the SMB client component within the cifs_try_adding_channels() function. The issue occurs because the function captures the next entry in ses->iface_list while holding iface_lock, but then drops the lock during cifs_ses_add_channel()....

EUVD-2026-93100

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix smbdconnection leak on cifsgettcpsession error When an RDMA connection is successfully established via smbdgetconnection but cifsgettcpsession later fails e.g. kthreadcreate returns an error, the error path frees...

CVE-2026-98172

The Linux kernel contains a vulnerability in the SMB client where an smbd_connection leak occurs. When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() subsequently fails (for example, if kthread_create() returns an error), the error path incorre...

CVE-2026-98171

The Linux kernel contains a vulnerability in the SMB client 's handling of compound encrypted frames within the receive_encrypted_standard() function. The issue stems from pointer lifecycle errors and insufficient bounds checking. Specifically, a use-after-free can occur because next_buffer is no...

EUVD-2026-93099

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix nextbuffer UAF and NextCommand bounds in compound PDUs Fix several related bounds checking and pointer lifecycle issues in receiveencryptedstandard's handling of compound encrypted frames: - Clear nextbuffer afte...

EUVD-2026-93098

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix OOB struct field reads in movesmb2eatocifs In movesmb2eatocifs, the while srcsize 0 loop condition is insufficient. It allows iteration to continue even if the remaining srcsize is too small to contain a complete...

CVE-2026-98170

The Linux kernel contains an out-of-bounds read vulnerability in the smb: client component within the move_smb2_ea_to_cifs() function. The root cause is an insufficient loop condition (while (src_size > 0)) that allows iteration to continue even when the remaining src_size is too small to hold...