CVE-2026-99016 riscv: futex: untag the user pointer before the atomic access

In the Linux kernel, the following vulnerability has been resolved: riscv: futex: untag the user pointer before the atomic access accessok checks untaggedaddruaddr, but archfutexatomicopinuser and futexatomiccmpxchginatomic hand the raw uaddr to the inline asm amoswap/amoadd/.../lr.w+sc.w through...

CVE-2026-99010 Bluetooth: RFCOMM: free the skb when the DLC has no owner

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99010 Bluetooth: RFCOMM: free the skb when the DLC has no owner

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99010

The Linux kernel Bluetooth RFCOMM component contains a memory leak vulnerability. The issue occurs in rfcomm_recv_data() when a Data Link Control (DLC) has no owner (e.g., after rfcomm_sock_destruct() clears d->owner but before the session closes). In the socket implementation, the skb is hand...

EUVD-2026-108804

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: free the skb when the DLC has no owner rfcommrecvdata hands the skb to d-dataready and returns 0 without freeing it, so the callback owns the skb from that point on. The tty implementation frees it when the DLC...

CVE-2026-99006 drm/i915/gem: Prevent overstepping exec array boundary

In the Linux kernel, the following vulnerability has been resolved: drm/i915/gem: Prevent overstepping exec array boundary It is possible for ebrelocateparseslow to call kvfree on entries outside the original exec array during following scenario inside ebrelocateparseslow: 1 ebcopyrelocations...

CVE-2026-99006

A vulnerability exists in the Linux kernel within the drm/i915/gem component. The issue is caused by the eb_relocate_parse_slow() function potentially calling kvfree() on entries outside the original exec array. This occurs because eb_parse() appends up to two VMAs after incrementing eb->buffe...

CVE-2026-99004 drm/imagination: Size page table preallocation by device address

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99004 drm/imagination: Size page table preallocation by device address

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99004

The Linux kernel contains a vulnerability in the drm/imagination driver related to how page table preallocation is sized by device address. The root cause involves an incorrect calculation where preallocation was sized from device_addr + sgt_offset with an exclusive end, causing the allocation of...

EUVD-2026-108794

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

EUVD-2026-108792

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

EUVD-2026-108787

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989

The Linux kernel contains a vulnerability where the do_loopback() function fails to properly check for recursive bind mount loops when using the MS_REC flag. Specifically, while it checks the starting dentry, it allows the copying of mount namespace files from other namespaces. This allows an att...

EUVD-2026-108783

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98972

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

EUVD-2026-108765

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-98971

The Linux kernel contains a vulnerability in the gpio: exar driver. The root cause is that gpio_exar_probe() stores an allocated ID in exar_gpio only after registering a cleanup action via devm_add_action_or_reset(). If registration fails, the cleanup action is invoked immediately; however, becau...