EUVD-2026-103616

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmacrx, when napibuildskb fails the descriptor page is recycled back to the page pool with pagepoolrecycledirect, but buf-page is left pointing at the...

CVE-2026-98571

The Linux kernel contains a vulnerability in the stmmac driver where buf->page is not cleared after a page is recycled via page_pool_recycle_direct() during a napi_build_skb() failure. This stale pointer causes stmmac_rx_refill() to skip replacement allocation and incorrectly program the alrea...

CVE-2026-98544

The Linux kernel contains a vulnerability where the bnad_pci_remove() and probe disable_ioceth paths fail to properly handle the iocpf_timer . While other timers are removed via timer_delete_sync() , the iocpf_timer remains active, leading bnad_iocpf_timeout() to attempt to take the bnad->bna_...

EUVD-2026-103582

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98537

The Linux kernel contains a vulnerability in the workqueue subsystem where the check_flush_dependency() function performs a NULL pointer dereference . The issue occurs because current_wq_worker() confirms the process is a workqueue worker, but the worker->current_pwq pointer remains NULL if th...

EUVD-2026-103763

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98523

The Linux kernel contains a vulnerability in the drm subsystem where a NULL pointer dereference can occur when closing a DRM file descriptor. The issue stems from drm_client_register() adding a client to the device list before the hotplug callback completes; if the callback fails, the client rema...

CVE-2026-98523 drm/client: fix restore of partially initialized client

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98523 drm/client: fix restore of partially initialized client

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98522

The Linux kernel contains a vulnerability in the drm/imagination driver where the pvr_mmu_map_sgl() interface failed to correctly propagate map failures to the pvr_mmu_map() interface. This flaw caused pvr_mmu_map() to continue execution instead of returning an error to the caller, potentially le...

EUVD-2026-103762

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98522 drm/imagination: Propagate map failures correctly from pvr_mmu_map_sgl()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

EUVD-2026-103750

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510 drm/xe/vm: nuke PTs only after unlinking contested VMAs

In the Linux kernel, the following vulnerability has been resolved: drm/xe/vm: nuke PTs only after unlinking contested VMAs In xevmcloseandput, external-BO VMAs are queued on the contested list for deferred destruction via xevmadestroyunlocked. However, xevmptdestroy was previously invoked before...

CVE-2026-98510

The Linux kernel contains a race condition in the drm/xe/vm component. In xe_vm_close_and_put(), xe_vm_pt_destroy() was incorrectly invoked before processing contested VMAs, destroying vm->pt_root while VMAs remained linked to buffer objects. If a concurrent thread evicts a shared buffer objec...

CVE-2026-98508 drm/virtio: fix NULL pointer dereference on fence allocation failure

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...