EUVD-2026-108783

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98972

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

CVE-2026-98971 gpio: exar: initialize the ID before registering its cleanup

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

EUVD-2026-108765

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-98971

The Linux kernel contains a vulnerability in the gpio: exar driver. The root cause is that gpio_exar_probe() stores an allocated ID in exar_gpio only after registering a cleanup action via devm_add_action_or_reset(). If registration fails, the cleanup action is invoked immediately; however, becau...

EUVD-2026-108764

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98970

The Linux kernel contains a memory leak vulnerability within the drm/vc4 component. Specifically, the vc4_bo_cache_destroy() function purges cached Buffer Objects (BOs) but fails to free the size list , resulting in a memory leak every time an unbind occurs. The provided documents do not include ...

CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98969 net/sched: em_text: reject unterminated algo before autoload

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

CVE-2026-98969

The Linux kernel contains a vulnerability in net/sched where em_text_change() fails to enforce a NUL terminator on the 16-byte algo array. When textsearch_prepare() is called on a TS_AUTOLOAD retry, vsnprintf() may perform an out-of-bounds read if the array is not terminated, leaking adjacent ker...

CVE-2026-98969 net/sched: em_text: reject unterminated algo before autoload

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

EUVD-2026-108763

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

CVE-2026-98966

The Linux kernel contained a vulnerability within the bonding module where BPF programs were leaked when XDP was replaced. The issue caused leaked programs to accumulate during propagation series tests. This vulnerability has been resolved by ensuring the kernel releases the reference on the old ...

CVE-2026-98966 bonding: fix the program leak when XDP is replaced

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

CVE-2026-98964 nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98964

The Linux kernel contains a vulnerability in the nvmet component where nvmet_req_alloc_p2pmem_sgls() fails to properly handle metadata allocation errors. Specifically, if data allocation succeeds but metadata allocation fails, the out_free_sg function passes req->p2p_dev to pci_p2pmem_free_sgl...

CVE-2026-98964 nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98962

The Linux kernel contains a vulnerability within the btrfs file system. Specifically, after the btrfs_uring_read_extent() function is called, the code incorrectly jumped to out_acct, causing it to skip the kfree(data->iov) operation. This memory deallocation is only appropriate for the -EIOCBQ...