CVE-2026-89447

In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...

CVE-2026-89446 iommufd: Release current IOAS on xa_store() failure

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray. If xastore fails, the current IOAS has not...

CVE-2026-80983

CVE-2026-80983 is a socket reference count leak in the Linux kernel's SMC (Stream Mode Communication) networking module, specifically in the smc_switch_conns() function. The function calls sock_hold() before releasing lgr->conns_lock, but when smc_cdc_get_free_slot() fails (e.g., the target li...

PT-2026-90361

In the Linux kernel, the following vulnerability has been resolved: btrfs: drop recovered reloc root refs on recovery failure During relocation recovery, each fs root gets a reference to its relocation root. If loading or adding a later root fails, or if the first transaction commit fails, btrfs...

PT-2026-90423

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on follow down error nfsd cross mnt initializes a local struct path with mntget and dget before calling follow down. On a negative return the error arm jumps to out without releasing those references: err ...

CVE-2026-89590: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocketjobrun In rocketjobrun, after taking an extra fence reference for job-donefence via dmafenceget, the error paths have three bugs: - The dmafence reference held by job-donefence is...

CVE-2026-89512: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

CVE-2026-89473: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...

PT-2026-90163

In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufd access notify unmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufd lock obj before...

PT-2026-90362

In the Linux kernel, the following vulnerability has been resolved: ceph: fix leaked inode reference on writeback abort at umount ceph dirty folio takes a wrbuffer claim on each newly dirtied folio: it bumps i wrbuffer ref taking an ihold on the 0-1 transition and attaches the snap context to...

PT-2026-90189

In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix power supply reference leak bq25890 fw probe acquires a reference to a secondary charger using power supply get by name, but the reference is not released on later probe failures or on driver detach. I...

CVE-2026-89707: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfsd: release path refs on followdown error nfsdcrossmnt initializes a local struct path with mntget and dget before calling followdown. On a negative return the error arm jumps to out without releasing those references: err =...

PT-2026-90162

In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xa store failure iommufd take all iova rwsem takes an object reference and the iova rwsem write lock before storing the IOAS in the temporary ioas list xarray. If xa store fails, the current IOAS...

PT-2026-90397

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix layout fence worker double-reference race The workqueue core clears WORK STRUCT PENDING before the callback is invoked, so delayed work pending in lm breaker timedout can return false while the fence worker is already...

PT-2026-90306

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: Fix error path handling in rocket job run In rocket job run, after taking an extra fence reference for job-done fence via dma fence get, the error paths have three bugs: - The dma fence reference held by job-done...

PT-2026-90431

In the Linux kernel, the following vulnerability has been resolved: NFS/localio: fix ref leak on nfs uuid add file failure When nfs uuid add file races with nfs uuid put tearing down uuid-net, it returns -ENXIO without publishing nfl-nfs uuid via rcu assign pointer. nfs open local fh then enters...

PT-2026-90169

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommu call iopf notifier looks up the requester with pci get domain bus and slot, which returns a PCI device with its reference count incremented. Neither the successful iommu...

PT-2026-90228

In the Linux kernel, the following vulnerability has been resolved: remoteproc: scp: Fix device reference leak on failed lookup Make sure to drop the reference taken to the SCP device when attempting to look up its driver data before the driver has been bound. Note that holding a reference to a...

SUSE CVE-2026-80888

In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: drop dmabuf reference on foreign-fd prime import ttmprimefdtohandle returns -ENOSYS when the imported fd's dmabuf-ops do not match the ttmobjectdevice's ops, but does so without releasing the reference acquired by...

SUSE CVE-2026-80897

In the Linux kernel, the following vulnerability has been resolved: netfs: release readahead folios on iterator preparation failure netfspreparereaditerator batches readahead folios in putbatch so that the folio references can be dropped after the I/O iterator has been prepared. If...