CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

EUVD-2026-86759

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...

CVE-2026-97905 cpufreq: zero-initialize policy cpumask before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...

CVE-2026-97904

The Linux kernel contains a vulnerability where cpufreq_policy_alloc() initializes the policy->rwsem semaphore after kobject_init_and_add() has already created the policy sysfs directory and its default attributes. This timing issue allows a sysfs access to reach a policy callback before the s...

CVE-2026-97904 cpufreq: initialize policy rwsem before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

CVE-2026-97904 cpufreq: initialize policy rwsem before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

EUVD-2026-86758

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

EUVD-2026-86756

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

CVE-2026-97902 fs: don't return -EINVAL for successful nested thaw

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...

CVE-2026-97903 exit: hold a reference to thread_pid across proc_flush_pid

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

CVE-2026-97902

The Linux kernel contains a vulnerability where thaw_super_locked() incorrectly returns -EINVAL when a nested thaw succeeds but other holders remain. This misinforms callers, specifically breaking bdev-initiated freezing . When a filesystem is frozen via FIFREEZE and nested via bdev_freeze(), the...

EUVD-2026-86757

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

CVE-2026-97903 exit: hold a reference to thread_pid across proc_flush_pid

In the Linux kernel, the following vulnerability has been resolved: exit: hold a reference to threadpid across procflushpid Commit 0a36bad01731 "releasetask: kill the no longer needed get/putpidthreadpid" removed the reference around procflushpid. It assumed that freepidspost.pids at the end of...

CVE-2026-97903

The Linux kernel is vulnerable to a slab-use-after-free issue due to an incorrect assumption in the release_task function. Specifically, the system failed to hold a proper reference to thread_pid across proc_flush_pid(). If another task uses the exiting task's PID as a process group or session ID...

CVE-2026-97900

The Linux kernel contains a vulnerability in the drm/drm_exec component where drm_exec_prepare_array() fails to call drm_exec_lock_contended() when num_objects is zero. This oversight breaks the locking invariant required by drm_exec_lock_obj() . Specifically, drivers that chain multiple calls, s...

CVE-2026-97901

The Linux kernel contains a vulnerability in the generic netlink controller where the policy dump keeps pointers to a target family's operation and policy tables in its callback state. Because Netlink only pins the module owning the dump callback (the controller's owner) rather than the target fa...

CVE-2026-97901 genetlink: pin family module during policy dump

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...

EUVD-2026-86754

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...

CVE-2026-97900 drm/drm_exec: fix up contended obj when num_objects is 0

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...

CVE-2026-97901 genetlink: pin family module during policy dump

In the Linux kernel, the following vulnerability has been resolved: genetlink: pin family module during policy dump The generic netlink controller's policy dump keeps pointers to the target family's operation and policy tables in its callback state. A dump may be split across multiple skbs and...