CVE-2026-98777

The Linux kernel contains a memory leak vulnerability within the binder component. When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed using kfree() directly. This process omits the necessary call to binder_free_txn_fixups...

CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98776

The Linux kernel contains a Use-After-Free (UAF) write vulnerability in the binderfs component. The issue occurs because binderfs_binder_device_create() publishes a new dentry but drops the parent directory lock and the creator's dentry reference before calling binder_add_device(). A concurrent u...

CVE-2026-98776 binderfs: fix UAF write in binder_add_device

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

EUVD-2026-103861

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

CVE-2026-98776 binderfs: fix UAF write in binder_add_device

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

EUVD-2026-103860

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure When necreatevmioctl fails the SLOTALLOC request after anoninodegetfile has succeeded, the error path calls fputenclavefile and then frees neenclave. In normal userspace...

CVE-2026-98775

The Linux kernel contains a use-after-free vulnerability in the nitro_enclaves component. Specifically, when ne_create_vm_ioctl() fails a SLOT_ALLOC request after anon_inode_getfile() succeeds, the error path calls fput(enclave_file) and then frees ne_enclave. Because fput() defers the final dest...

CVE-2026-98775 nitro_enclaves: fix use-after-free on SLOT_ALLOC failure

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure When necreatevmioctl fails the SLOTALLOC request after anoninodegetfile has succeeded, the error path calls fputenclavefile and then frees neenclave. In normal userspace...

CVE-2026-98775 nitro_enclaves: fix use-after-free on SLOT_ALLOC failure

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure When necreatevmioctl fails the SLOTALLOC request after anoninodegetfile has succeeded, the error path calls fputenclavefile and then frees neenclave. In normal userspace...

CVE-2026-98773

The Linux kernel contains a vulnerability in the cdc-acm driver where acm_port_shutdown() unconditionally calls acm_unpoison_urbs(). When the ALWAYS_POLL_CTRL quirk is active, this causes the re-submission of control and read URBs even if the device is being disconnected. Because acm_disconnect()...

EUVD-2026-103858

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

EUVD-2026-103859

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98774

The Linux kernel contains a vulnerability in rust_binder where deferred work items on a thread's todo list are not properly cleaned up during the Thread::release() method. This occurs specifically when a thread terminates while maintaining an active outgoing transaction. The issue has been addres...

CVE-2026-98773 USB: cdc-acm: skip URB restart in port_shutdown if disconnected

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98774 rust_binder: cancel deferred work items in thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98774 rust_binder: cancel deferred work items in thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98773 USB: cdc-acm: skip URB restart in port_shutdown if disconnected

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98772 USB: serial: fix port tear down use-after-free

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...