CVE-2026-99004 drm/imagination: Size page table preallocation by device address

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99004 drm/imagination: Size page table preallocation by device address

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Size page table preallocation by device address Commit 0a8224058a58 "drm/imagination: Fix page count for page table for map interface" passed the device address to pvrmmuopcontextcreate, but the preallocation is...

CVE-2026-99004

The Linux kernel contains a vulnerability in the drm/imagination driver related to how page table preallocation is sized by device address. The root cause involves an incorrect calculation where preallocation was sized from device_addr + sgt_offset with an exclusive end, causing the allocation of...

EUVD-2026-108794

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix shrinker accounting double-subtraction on nested external pins xebopinexternal and xebounpinexternal support nested pins, since the underlying ttmbopin/ttmbounpin maintain a pincount refcount rather than a boolean...

EUVD-2026-108792

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: th1520-dw-hdmi: Fix remove callback This driver stores struct th1520hdmi in platform drvdata, but th1520dwhdmiremove was reading it back as struct dwhdmi and passing it to dwhdmiremove, so teardown runs on the wrong...

EUVD-2026-108787

In the Linux kernel, the following vulnerability has been resolved: namespace: don't inherit MNTUMOUNT in clonemnt MNTUMOUNT gets raised on a mount that umounttree or umountone has taken out of its namespace. It's never cleared. detachmounts unhooks a mount that carries it instead of unmounting i...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989

The Linux kernel contains a vulnerability where the do_loopback() function fails to properly check for recursive bind mount loops when using the MS_REC flag. Specifically, while it checks the starting dentry, it allows the copying of mount namespace files from other namespaces. This allows an att...

EUVD-2026-108783

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98989 namespace: check a recursive bind mount for mount namespace loops

In the Linux kernel, the following vulnerability has been resolved: namespace: check a recursive bind mount for mount namespace loops doloopback refuses to bind mount the file of a mount namespace that is as old as the caller's or older because a mount namespace that holds a mount of its own file...

CVE-2026-98972

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

CVE-2026-98971 gpio: exar: initialize the ID before registering its cleanup

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

EUVD-2026-108765

In the Linux kernel, the following vulnerability has been resolved: gpio: exar: initialize the ID before registering its cleanup devmaddactionorreset invokes the cleanup action immediately when registering the action fails. gpioexarprobe currently stores the allocated ID in exargpio only after...

CVE-2026-98971

The Linux kernel contains a vulnerability in the gpio: exar driver. The root cause is that gpio_exar_probe() stores an allocated ID in exar_gpio only after registering a cleanup action via devm_add_action_or_reset(). If registration fails, the cleanup action is invoked immediately; however, becau...

CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

EUVD-2026-108764

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98970 drm/vc4: Free the BO cache size list on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Free the BO cache size list on teardown vc4bocachedestroy purges the cached BOs but never frees the size list, leaking it on every unbind...

CVE-2026-98970

The Linux kernel contains a memory leak vulnerability within the drm/vc4 component. Specifically, the vc4_bo_cache_destroy() function purges cached Buffer Objects (BOs) but fails to free the size list , resulting in a memory leak every time an unbind occurs. The provided documents do not include ...

CVE-2026-98969 net/sched: em_text: reject unterminated algo before autoload

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

EUVD-2026-108763

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...