CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64147

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...

EUVD-2026-45832

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix debugfslookup dentry leak and error handling debugfslookup returns a dentry with an elevated reference count that must be released with dput. The current code discards the returned dentry without calling dput, causin...

CVE-2026-64142 ksmbd: close durable scavenger races against m_fp_list lookups

In the Linux kernel, the following vulnerability has been resolved: ksmbd: close durable scavenger races against mfplist lookups ksmbddurablescavenger has two related races against any walker that iterates fci-mfplist, including ksmbdlookupfdinode used by ksmbdvfsrename and the share-mode checks ...

CVE-2026-64108 cifs: Fix busy dentry used after unmounting

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix busy dentry used after unmounting Since commit 340cea84f691c "cifs: open files should not hold ref on superblock", cifs file only holds the dentry refcnt, the cifs file close workcfile-deferred could be executed after...

CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64044 ovpn: respect peer refcount in CMD_NEW_PEER error path

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-63950 mm/rmap: initialize nr_pages to 1 at loop start in try_to_unmap_one

In the Linux kernel, the following vulnerability has been resolved: mm/rmap: initialize nrpages to 1 at loop start in trytounmapone Initialize nrpages to 1 at the start of each loop iteration, like folioreferencedone does. Without this, nrpages computed by a previous foliounmapptebatch call can b...

CVE-2026-63929

The CVE-2026-63929 issue is in the Linux kernel iio subsystem, specifically iio_buffer_enqueue_dmabuf() which allocates a iio_dma_fence and calls dma_resv_add_fence(). The initial reference from dma_fence_init() (kref=1) is not released on the success path, while dma_resv_add_fence() takes a seco...

CVE-2026-63906 usb: musb: omap2430: Fix use-after-free in omap2430_probe()

In the Linux kernel, the following vulnerability has been resolved: usb: musb: omap2430: Fix use-after-free in omap2430probe In omap2430probe, ofnodeputnp is called prematurely before the last access to np, leading to a use-after-free if the node's reference count drops to zero. Move the ofnodepu...

CVE-2026-63823

In the Linux kernel, the following vulnerability has been resolved: keys: Pin requestkeyauth payload in instantiate paths A: requestkey B: KEYCTLINSTANTIATEIOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy...

CVE-2026-63795

In the Linux kernel, the following vulnerability has been resolved: 9p: avoid putting oldfid in p9clientwalk error path When p9clientwalk is called with clone set to false, fid aliases oldfid. If the walk subsequently fails after the request has been sent, the error path jumps to clunkfid, which...

PT-2026-61235

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcount inc not zero in l2tp session get by ifname A reader in l2tp session get by ifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcount inc, but...

PT-2026-61139

In the Linux kernel, the following vulnerability has been resolved: keys: Pin request key auth payload in instantiate paths A: request key B: KEYCTL INSTANTIATE IOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key...

drm/virtio: fix dma_fence refcount leak on error in virtio_gpu_dma_fence_wait()

...

CVE-2026-53281

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d "iommu/vt-d: Avoid use of NULL after WARNONONCE" fixed a NULL pointer dereference in an unlikely situation partly. If devpasid is not found in...

CVE-2026-53281 iommu/vt-d: Avoid NULL pointer dereference or refcount corruption

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Avoid NULL pointer dereference or refcount corruption Commit 60f030f7418d "iommu/vt-d: Avoid use of NULL after WARNONONCE" fixed a NULL pointer dereference in an unlikely situation partly. If devpasid is not found in...

CVE-2026-53281

The CVE-2026-53281 entries describe a Linux kernel IOMMU VT-d issue where NULL pointer dereference or refcount corruption could occur during teardown if dev_pasid was not found in the dev_pasids list or if domain was never attached. The root cause was improper teardown execution after potential N...

PT-2026-52920

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A NULL pointer dereference or refcount corruption exists in the iommu/vt-d component. When dev pasid is not found in the dev pasids list and remains NULL, teardown operations are execute...

UBUNTU-CVE-2026-53161

In the Linux kernel, the following vulnerability has been resolved: misc: fastrpc: fix use-after-free of fastrpcuser in workqueue context There is a race between fastrpcdevicerelease and the workqueue that processes DSP responses. When the user closes the file descriptor, fastrpcdevicerelease fre...