CVE-2026-64152

CVE-2026-64152 affects the Linux kernel iommu path. The issue arises when an unmap error in the iommu_debug flow occurs in an error path that did not establish the original iommu_debug_map, causing mis-tracing and unbalanced tracking. Fix: move the unmap error handling into iommu_map_nosync() and...

CVE-2026-64152 iommu: Handle unmap error when iommu_debug is enabled

In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...

EUVD-2026-45837

In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...

CVE-2026-64152 iommu: Handle unmap error when iommu_debug is enabled

In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...

CVE-2026-64152

In the Linux kernel, the following vulnerability has been resolved: iommu: Handle unmap error when iommudebug is enabled Sashiko noticed a latent bug where the map error flow called iommuunmap which calls iommudebugunmapbegin/iommudebugunmapend however since this is an error path the map flow nev...

CVE-2026-64149

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64118

In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qedcxttablesalloc If one of the later PF or VF CID bitmap allocations fails, qedcidmapalloc jumps to cidmapfail and frees the previously allocated CID bitmaps before returning an error. qedcxttablesalloc...

CVE-2026-64118 qed: fix double free in qed_cxt_tables_alloc()

In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qedcxttablesalloc If one of the later PF or VF CID bitmap allocations fails, qedcidmapalloc jumps to cidmapfail and frees the previously allocated CID bitmaps before returning an error. qedcxttablesalloc...

CVE-2026-64052

CVE-2026-64052 is a null pointer dereference in the Linux kernel's block layer , specifically in bio_integrity_map_user(). The root cause is that pin_user_pages_fast() can partially succeed (pinning fewer pages than requested), but bio_integrity_map_user() does not handle this case, causing bvec_...

CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-64008

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-64008

The CVE-2026-64008 issue affects the Linux kernel’s accel/rocket path. rocket_ioctl_create_bo() creates a GEM handle early via drm_gem_handle_create(), then proceeds through fallible steps (sgt allocation, drm_mm insert, iommu_map). If any step fails after the handle is live, the error path frees...

CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

EUVD-2026-45581

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-63954

In the Linux kernel, the following vulnerability has been resolved: hpfs: fix a crash if hpfsmapdnodebitmap fails If hpfsmapdnodebitmap fails, the code would call hpfsbrelse4 on uninitialized quad buffer head, causing a crash...

CVE-2026-63926 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpfmsgpushdata When bpfmsgpushdata inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is...

CVE-2026-53382

In the Linux kernel, the following vulnerability has been resolved: media: vidtv: fix NULL pointer dereference in vidtvmuxpushsi syzbot reported a general protection fault in vidtvpsitspsiwriteinto 1. vidtvmuxgetpidctx can return NULL, but vidtvmuxpushsi does not check for this before dereferenci...

CVE-2026-53382

CVE-2026-53382 affects the Linux kernel’s media/vidtv subsystem. The issue arises when vidtv_mux_get_pid_ctx() returns NULL and vidtv_mux_push_si() dereferences it to access the continuity counter, triggering a general protection fault. Root cause: vidtv_mux_pid_ctx_init() could skip creating a P...