CVE-2026-98777

The Linux kernel contains a memory leak vulnerability within the binder component. When a TF_UPDATE_TXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed using kfree() directly. This process omits the necessary call to binder_free_txn_fixups...

CVE-2026-98777 binder: fix leaked fd fixups on TF_UPDATE_TXN supersede

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

EUVD-2026-103858

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98774 rust_binder: cancel deferred work items in thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

EUVD-2026-103859

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98774

The Linux kernel contains a vulnerability in rust_binder where deferred work items on a thread's todo list are not properly cleaned up during the Thread::release() method. This occurs specifically when a thread terminates while maintaining an active outgoing transaction. The issue has been addres...

CVE-2026-98774 rust_binder: cancel deferred work items in thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

EUVD-2026-103845

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

CVE-2026-98740 EDAC/altera: Drop __init from ECC setup paths for re-probe safety

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Drop init from ECC setup paths for re-probe safety Sashiko reports: "Does suppressing sysfs unbinding fully prevent the execution of freed init memory? If altrsysmgrregmaplookupbyphandle returns -EPROBEDEFER, the pro...

CVE-2026-98740

The Linux kernel contains a vulnerability where several a10 EDAC .setup callbacks (including sdmmc, ethernet, nand, dma, usb, and qspi) and their helpers were incorrectly marked with init . This allows for potential dereferencing of freed memory if a probe is deferred via -EPROBE_DEFER or trigge...

EUVD-2026-103972

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

CVE-2026-98718 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

CVE-2026-98718

The Linux kernel contains a vulnerability in the KVM: SEV component where cache maintenance is performed after clearing the SEV active state on a source VM during intra-host migration. This sequence creates a race condition window where memory reclaim might return memory to the host without a pro...

CVE-2026-98718 KVM: SEV: Do cache maintenance on the source VM *before* clearing SEV state

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM before clearing SEV state Explicitly flush caches after intra-host migration before clearing "SEV active" on the source VM, as doing cache maintenance afterwards creates a tiny wind...

EUVD-2026-103964

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710

The Linux kernel contains a memory leak vulnerability in the wifi: iwlegacy: 3945 driver. Specifically, while the il3945_pci_probe() function calls il_eeprom_init() to allocate memory for EEPROM data, the remove path fails to release this memory after a successful probe. This results in EEPROM da...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

EUVD-2026-103957

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...

CVE-2026-98703 wifi: mac80211: minstrel_ht: validate fixed rate index

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: minstrelht: validate fixed rate index The fixedrateidx debugfs file is a plain u32 attribute, so any value can be written to it. minstrelhtupdatestats then copies the value into mi-maxtprate and mi-maxprobrate, an...