CVE-2026-97908

The Linux kernel contains a vulnerability in the btqcomsmd Bluetooth driver where RPMsg endpoints are destroyed after the hci_dev is freed. Because receive callbacks dereference btq->hdev without taking a reference, a window exists where WCNSS data delivery can cause the callback to run with a...

EUVD-2026-86761

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

CVE-2026-97907

The Linux kernel contains a vulnerability in the Bluetooth btrtl component within the rtlbt_parse_firmware_v2() function. When the key_id from the chip is zero, the function is intended to ignore security headers; however, it incorrectly breaks from a switch statement, causing it to leak an unini...

EUVD-2026-86762

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

CVE-2026-97905

The Linux kernel contains a vulnerability in the cpufreq component where policy->cpus is allocated without being zero-initialized when CONFIG_CPUMASK_OFFSTACK=y is enabled. Because alloc_cpumask_var() does not guarantee zeroing, the bitmap may contain garbage data from the slab allocator. This...

EUVD-2026-86760

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97906

The Linux kernel is affected by an integer overflow vulnerability within the get_boot_config_from_initrd() function. A crafted initrd with an excessively large bootconfig size (e.g., 0xFFFFFFFF) causes pointer arithmetic to wrap around, specifically when calculating data = ((void *)hdr) - size. T...

EUVD-2026-86759

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...

CVE-2026-97904 cpufreq: initialize policy rwsem before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

CVE-2026-97904

The Linux kernel contains a vulnerability where cpufreq_policy_alloc() initializes the policy->rwsem semaphore after kobject_init_and_add() has already created the policy sysfs directory and its default attributes. This timing issue allows a sysfs access to reach a policy callback before the s...

EUVD-2026-86758

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

CVE-2026-97904 cpufreq: initialize policy rwsem before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

EUVD-2026-86756

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

EUVD-2026-86757

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

CVE-2026-97903 exit: hold a reference to thread_pid across proc_flush_pid

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

CVE-2026-97902

The Linux kernel contains a vulnerability where thaw_super_locked() incorrectly returns -EINVAL when a nested thaw succeeds but other holders remain. This misinforms callers, specifically breaking bdev-initiated freezing . When a filesystem is frozen via FIFREEZE and nested via bdev_freeze(), the...

CVE-2026-97903

The Linux kernel is vulnerable to a slab-use-after-free issue due to an incorrect assumption in the release_task function. Specifically, the system failed to hold a proper reference to thread_pid across proc_flush_pid(). If another task uses the exiting task's PID as a process group or session ID...

CVE-2026-97900

The Linux kernel contains a vulnerability in the drm/drm_exec component where drm_exec_prepare_array() fails to call drm_exec_lock_contended() when num_objects is zero. This oversight breaks the locking invariant required by drm_exec_lock_obj() . Specifically, drivers that chain multiple calls, s...

EUVD-2026-86754

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...

CVE-2026-97901

The Linux kernel contains a vulnerability in the generic netlink controller where the policy dump keeps pointers to a target family's operation and policy tables in its callback state. Because Netlink only pins the module owning the dump callback (the controller's owner) rather than the target fa...