CVE-2026-64186

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...

CVE-2026-64062

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfsadvancewritethrough to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until t...

EUVD-2026-45871

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...

EUVD-2026-45834

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149

The Linux kernel's dma_map_resource() used pfn_valid() to verify a PFN range is not RAM, but this check only confirms memory map availability, not actual RAM backing. On ARM64 SPARSEMEM systems with 128MB sections, MMIO addresses sharing a section with RAM falsely triggered WARN_ON_ONCE, causing ...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64149 dma-mapping: move dma_map_resource() sanity check into debug code

In the Linux kernel, the following vulnerability has been resolved: dma-mapping: move dmamapresource sanity check into debug code dmamapresource uses pfnvalid to ensure the range is not RAM. However, pfnvalid only checks for availability of the memory map for a PFN but it does not ensure that the...

CVE-2026-64062 netfs: Fix potential deadlock in write-through mode

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfsadvancewritethrough to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until t...

EUVD-2026-45635

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix potential deadlock in write-through mode Fix netfsadvancewritethrough to always unlock the supplied folio and to mark it dirty if it isn't yet written to the end. Unfortunately, it can't be marked for writeback until t...

kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries SPTEs during memory-mapped I/O MMIO operations. By manipulating guest page table entrie...

kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries SPTEs during memory-mapped I/O MMIO operations. By manipulating guest page table entrie...

kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries SPTEs during memory-mapped I/O MMIO operations. By manipulating guest page table entrie...

kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM component. A local attacker with privileges on the host system could exploit a vulnerability in how KVM handles shadow page table entries SPTEs during memory-mapped I/O MMIO operations. By manipulating guest page table entrie...

PT-2026-70013

Name of the Vulnerable Software and Affected Versions FreeBSD affected versions not specified Description Calling the msyncMS INVALIDATE function on a mapping of an unmanaged device object causes physical pages in the mapping range to be marked invalid while remaining in the pager's page list. A...

FreeBSD -- Use-after-free in device pager page list

Problem Description: When msyncMSINVALIDATE is called on a mapping of an unmanaged device object, the physical pages in the mapping range are marked invalid but remain in the pager's page list. A subsequent page fault will cause the fault handler to re-insert the page into the object's list. This...

CVE-2026-53250

A flaw was found in the Linux kernel's xsk AFXDP socket component. A malicious local userspace application can exploit a Time-of-check to time-of-use TOCTOU race condition in the xskskbmetadata function. By modifying checksum-related values in shared memory between validation and use, an attacker...

DEBIAN-CVE-2026-53294

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't free the reused channel The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs...

CVE-2026-53294

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't free the reused channel The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs...

CVE-2026-53294

In the Linux kernel, the following vulnerability has been resolved: mailbox: mailbox-test: don't free the reused channel The RX channel can be aliased to the TX channel if it has a different MMIO. This special case needs to be handled when freeing the channels otherwise a double-free occurs...