CVE-2026-98690

The Linux kernel contains a vulnerability in the thunderbolt driver where a domain reference is leaked when a DPRX read is canceled. Specifically, the tb_tunnel_one_dp() function takes a reference that is only dropped once; if tb_dp_tunnel_active() work is canceled, the reference remains leaked. ...

CVE-2026-98680 iio: accel: kionix-kx022a: Prevent memory leak and fix state

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

CVE-2026-98680

The Linux kernel contains a vulnerability in the iio: accel: kionix-kx022a driver. During the buffer enable path, the kx022a_fifo_enable() function fails to free allocated memory if a regmap operation fails. Additionally, the driver fails to revert hardware configurations and state flags on error...

CVE-2026-98680 iio: accel: kionix-kx022a: Prevent memory leak and fix state

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

CVE-2026-98680

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

EUVD-2026-103934

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

CVE-2026-98671 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure

In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devmthermalofzoneregister fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to errmap to release them...

CVE-2026-98671

The Linux kernel contains a vulnerability in the iio: adc: sun4i-gpadc-iio component. When the devm_thermal_of_zone_register() function fails, the probe process returns without unregistering the IIO map array or disabling runtime PM . This issue was resolved by ensuring the code jumps to err_map ...

CVE-2026-98671 iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure

In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devmthermalofzoneregister fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to errmap to release them...

EUVD-2026-103925

In the Linux kernel, the following vulnerability has been resolved: iio: adc: sun4i-gpadc-iio: clean up on thermal zone registration failure If devmthermalofzoneregister fails, probe returns without unregistering the IIO map array or disabling runtime PM. Jump to errmap to release them...

CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

EUVD-2026-103922

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98668

The Linux kernel contains a vulnerability where the function iio_push_to_buffers_with_ts_unaligned() leaks uninitialized heap memory to userspace. This occurs when the data passed in is not a multiple of 8 bytes and the timestamp is enabled. The issue is resolved by specifying __GFP_ZERO for the ...

CVE-2026-98668 iio: buffer: Ensure bounce buffer used for unaligned case is zeroed.

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Ensure bounce buffer used for unaligned case is zeroed. iiopushtobufferswithtsunaligned leaks uninitialized heap memory to userspace if the data passed in is not a multiple of 8 bytes and the timestamp is enabled...

CVE-2026-98653

The Linux kernel contains a vulnerability within the KVM s390 subsystem. Specifically, in certain circumstances, a page of nested guest memory being shadowed may be missing from the parent guest gmap . This causes dat_entry_walk() to fail to find a leaf entry and return -ENOENT , which is then er...

CVE-2026-98653 KVM: s390: Fix _gaccess_shadow_fault()

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...

CVE-2026-98640 HID: amd_sfh: Validate PCI BAR size before mapping

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

EUVD-2026-103554

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

CVE-2026-98640

The Linux kernel contains a vulnerability in the amd_sfh driver where it maps PCI BAR 2 using pcim_iomap_regions() without validating if the BAR size is sufficient for subsequent MMIO register accesses (up to offset 0x10958). If the driver binds to a device with a smaller BAR 2, it results in an ...

CVE-2026-98640 HID: amd_sfh: Validate PCI BAR size before mapping

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...