EUVD-2026-45864

In the Linux kernel, the following vulnerability has been resolved: net: wwan: iosm: fix potential memory leaks in ipcimeminit The memory allocated in ipcprotocolinit is not freed on the error paths that follow in ipcimeminit. Fix that by calling the corresponding release function ipcprotocoldein...

CVE-2026-64173 tracing: Do not call map->ops->elt_free() if elt_alloc() fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Do not call map-ops-eltfree if eltalloc fails In paths where tracingmapeltalloc failed to allocate objects, the map-ops-eltalloc call was never successful. In this case, map-ops-eltfree should not be called...

CVE-2026-64165

In the Linux kernel, the following vulnerability has been resolved: ARM: integrator: Fix early initialization Starting with commit bdb249fce9ad4 "ARM: integrator: read counter using syscon/regmap", intcpinitearly calls sysconregmaplookupbycompatible which in turn calls ofsysconregister. This...

CVE-2026-64131 mm/memory: fix spurious warning when unmapping device-private/exclusive pages

In the Linux kernel, the following vulnerability has been resolved: mm/memory: fix spurious warning when unmapping device-private/exclusive pages Device private and exclusive entries are only supported for anonymous folios. This condition is tested in migratedevicepages and makedeviceexclusive...

CVE-2026-64118

The CVE-2026-64118 issue is a Linux kernel memory-management bug in qed_cxt_tables_alloc(): if a later PF/VF CID bitmap allocation fails, qed_cid_map_alloc() jumps to cid_map_fail and frees previously allocated CID bitmaps; then qed_cxt_tables_alloc() calls qed_cxt_mngr_free(), which invokes qed_...

EUVD-2026-45803

In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qedcxttablesalloc If one of the later PF or VF CID bitmap allocations fails, qedcidmapalloc jumps to cidmapfail and frees the previously allocated CID bitmaps before returning an error. qedcxttablesalloc...

CVE-2026-64118 qed: fix double free in qed_cxt_tables_alloc()

In the Linux kernel, the following vulnerability has been resolved: qed: fix double free in qedcxttablesalloc If one of the later PF or VF CID bitmap allocations fails, qedcidmapalloc jumps to cidmapfail and frees the previously allocated CID bitmaps before returning an error. qedcxttablesalloc...

CVE-2026-64071 nvme-pci: fix use-after-free in nvme_free_host_mem()

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: fix use-after-free in nvmefreehostmem nvmefreehostmem frees dev-hmbsgt via dmafreenoncontiguous but never clears the pointer afterward. This leads to a use-after-free if nvmefreehostmem is called twice in the same error...

CVE-2026-64059 netfs: Fix folio->private handling in netfs_perform_write()

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

CVE-2026-64050 drm/msm/dpu: don't mix devm and drmm functions

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dpu: don't mix devm and drmm functions Mixing devm and drmm functions will result in a use-after-free on msm driver teardown if userspace keeps a reference on the drm device: The WB connector data will be destroyed becaus...

EUVD-2026-45581

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-63951

In the Linux kernel, the following vulnerability has been resolved: zram: fix use-after-free in zramwritebackendio A crash was observed in zramwritebackendio due to a NULL pointer dereference in wakeup. The root cause is a race condition between the bio completion handler zramwritebackendio and t...

EUVD-2026-45723

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nrpages to 1 at loop start in trytounmapone Initialize nrpages to 1 at the start of each loop iteration, like folioreferencedone does. Without this, nrpages computed by a previous foliounmapptebatch call can b...

CVE-2026-63930 iio: buffer: hw-consumer: fix use-after-free in error path

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: hw-consumer: fix use-after-free in error path In the errputbuffers cleanup path of iiohwconsumeralloc, the code was using listforeachentry to iterate through buffers while calling iiobufferput which can free the...

EUVD-2026-45558

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Fix mmstruct reference leak in aie2populaterange aie2populaterange jumps back to the again label without calling mmputmm, leaking a reference to the mmstruct. Add the missing mmput before jumping to again...

CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

EUVD-2026-45479

In the Linux kernel, the following vulnerability has been resolved: Revert "f2fs: remove non-uptodate folio from the page cache in movedatablock" This reverts commit 9609dd704725a40cd63d915f2ab6c44248a44598. The kernel panics are keeping to be reported especially when the f2fs partition get almos...

CVE-2026-63809

CVE-2026-63809 affects the Linux kernel memory-management path used by BPF when handling proc sysctl writes. The vulnerability stems from proc_sys_call_handler() allocating a temporary sysctl buffer with kvzalloc() and passing it to __cgroup_bpf_run_filter_sysctl(); since kvzalloc() may fall back...

CVE-2026-63809 bpf: use kvfree() for replaced sysctl write buffer

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...

CVE-2026-63809

In the Linux kernel, the following vulnerability has been resolved: bpf: use kvfree for replaced sysctl write buffer procsyscallhandler allocates its temporary sysctl buffer with kvzalloc and passes it to cgroupbpfrunfiltersysctl. Since kvzalloc may fall back to vmalloc for large allocations,...