29702 matches found
CVE-2026-89473 power: supply: bq25890: Fix power_supply reference leak
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...
CVE-2026-89473
In the Linux kernel, the following vulnerability has been resolved: power: supply: bq25890: Fix powersupply reference leak bq25890fwprobe acquires a reference to a secondary charger using powersupplygetbyname, but the reference is not released on later probe failures or on driver detach. In...
CVE-2026-89453 iommu/amd: Put PCI device after handling PPR faults
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Put PCI device after handling PPR faults iommucalliopfnotifier looks up the requester with pcigetdomainbusandslot, which returns a PCI device with its reference count incremented. Neither the successful...
CVE-2026-89453
CVE-2026-89453 is a PCI device reference count leak in the Linux kernel's iommu/amd subsystem. The function iommu_call_iopf_notifier() calls pci_get_domain_bus_and_slot() which increments the device's reference count, but neither the successful iommu_report_device_fault() path nor the abort path ...
CVE-2026-89447 iommufd: Avoid locking internal accesses during unmap
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
CVE-2026-89447
CVE-2026-89447 affects the Linux kernel iommufd subsystem. In iommufd_access_notify_unmap() , the code calls iommufd_lock_obj() before checking whether the access is internal. When the access is internal, the loop skips it via continue, bypassing the matching iommufd_put_object() call used by the...
EUVD-2026-76353
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
CVE-2026-89447 iommufd: Avoid locking internal accesses during unmap
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
CVE-2026-89447
In the Linux kernel, the following vulnerability has been resolved: iommufd: Avoid locking internal accesses during unmap iommufdaccessnotifyunmap skips internal accesses because they do not have an external unmap callback to invoke. However, the current test calls iommufdlockobj before checking...
CVE-2026-89446 iommufd: Release current IOAS on xa_store() failure
In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray. If xastore fails, the current IOAS has not...
CVE-2026-89446 iommufd: Release current IOAS on xa_store() failure
In the Linux kernel, the following vulnerability has been resolved: iommufd: Release current IOAS on xastore failure iommufdtakealliovarwsem takes an object reference and the iovarwsem write lock before storing the IOAS in the temporary ioaslist xarray. If xastore fails, the current IOAS has not...
EUVD-2026-76324
In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...
CVE-2026-80983
CVE-2026-80983 is a socket reference count leak in the Linux kernel's SMC (Stream Mode Communication) networking module, specifically in the smc_switch_conns() function. The function calls sock_hold() before releasing lgr->conns_lock, but when smc_cdc_get_free_slot() fails (e.g., the target li...
CVE-2026-80926 ksmbd: fix use-after-free in oplock break notification
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...
CVE-2026-80926
CVE-2026-80926 is a use-after-free in the Linux kernel's ksmbd (in-kernel SMB server) module, in the smb2_oplock_break_noti() function. The function reads opinfo->conn without holding a lock and dereferences it after two allocations that may sleep. When the durable handle owning the oplock is ...
CVE-2026-80926 ksmbd: fix use-after-free in oplock break notification
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...
EUVD-2026-76248
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...
CVE-2026-80926
In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix use-after-free in oplock break notification smb2oplockbreaknoti reads opinfo-conn without any lock and dereferences it after two allocations which may sleep. When the durable handle owning the oplock is disconnected,...
