CVE-2026-115722

RPly through 1.1.4 contains an improper array index validation vulnerability in plyreadheaderproperty that accepts list as a list property's length or value type. Attackers can supply a crafted PLY file that makes plyreadlistproperty call an out-of-bounds handler, crashing ASCII parsing or...

CVE-2026-98895

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98942

The Linux kernel contains a vulnerability in the sched_ext component where cid tables were visible to cid kfuncs while being modified. Specifically, the first enable published global pointers before they were filled, and subsequent operations overrode them in place. This allowed a racing TRACING ...

EUVD-2026-108914

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

CVE-2026-98942 sched_ext: Build the cid tables privately and publish them with RCU

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

CVE-2026-98942 sched_ext: Build the cid tables privately and publish them with RCU

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

CVE-2026-98938 rust: irq: pass RegistrationInner as cookie to request_irq

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

EUVD-2026-108910

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

CVE-2026-98938

The Linux kernel contains a vulnerability within the Rust implementation of IRQ handling. Specifically, because Devres::new() returns a Result by value (introduced in commit ba268514ea14), the registration.inner field remains uninitialized when request_irq() is called. This allows the IRQ callbac...

CVE-2026-98938 rust: irq: pass RegistrationInner as cookie to request_irq

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

CVE-2026-98932

The Linux kernel contains a use-after-free vulnerability within the EDAC/altera component. Specifically, in both altr_edac_a10_device_add() and altr_portb_setup(), the error path incorrectly freed the dci structure before releasing the devres group . Because managed single and double bit IRQ hand...

CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

EUVD-2026-108904

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98918

The Linux kernel contains a vulnerability where the DAMON (Deterministic Autorecover Memory Number) subsystem can cause a memory overrun on arm64 architectures. The issue arises in damon_ptep_mkold() because a random byte address, which may be unaligned, is passed to a page table walk. In some ca...

CVE-2026-98918 mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damonptepmkold damonvaprepareaccesscheck picks a random byte address within the region and stores it in r-samplingaddr. damonvamkold passes it into a page table walk, which hands...

CVE-2026-98918 mm/damon/ops-common: use a page-aligned address in damon_ptep_mkold()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damonptepmkold damonvaprepareaccesscheck picks a random byte address within the region and stores it in r-samplingaddr. damonvamkold passes it into a page table walk, which hands...

CVE-2026-98911 dpaa2-switch: fix the error path in dpaa2_switch_rx()

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...

EUVD-2026-108867

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...

CVE-2026-98911

The Linux kernel contains a vulnerability in the dpaa2-switch driver within the dpaa2_switch_rx() function. The issue arises because the dpaa2_switch_free_fd() function is incorrectly called during an error path; this function is intended for Tx frame descriptors and expects a valid skb pointer i...