EUVD-2026-48964

In the Linux kernel, the following vulnerability has been resolved: mfd: crosec: Delay devsetdrvdata until probe success If ecdeviceprobe fails, crosecclassrelease releases memory for the crosecdev structure. However, because the drvdata was already set, sub-drivers like crosectypec can still...

EUVD-2026-48920

In the Linux kernel, the following vulnerability has been resolved: firmwareloader: fix device reference leak in firmwareuploadregister firmwareuploadregister - fwcreateinstance - deviceinitialize After fwcreateinstance succeeds, the lifetime of the embedded struct device is expected to be manage...

CVE-2026-64358 media: mtk-jpeg: cancel workqueue on release for supported platforms only

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

EUVD-2026-48902

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64358 media: mtk-jpeg: cancel workqueue on release for supported platforms only

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64358

In the Linux kernel, the following vulnerability has been resolved: media: mtk-jpeg: cancel workqueue on release for supported platforms only Since a recent fix the mtkjpegrelease function cancels any pending or running work present in the driver workqueue using cancelworksync function. Currently...

CVE-2026-64356

The CVE-2026-64356 issue affects the Linux kernel XFS metadir path, specifically a memory leak in xfs_dqinode_metadir_create() when xfs_metadir_create() fails inside xfs_dqinode_metadir_create(). The root cause is that, on failure, the code returns without freeing the allocated update and transac...

EUVD-2026-48900

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

CVE-2026-64356 xfs: fix memory leak in xfs_dqinode_metadir_create()

In the Linux kernel, the following vulnerability has been resolved: xfs: fix memory leak in xfsdqinodemetadircreate If xfsmetadircreate fails in xfsdqinodemetadircreate, the current code returns directly, leaking the allocated update and transaction state. If the subsequent commit fails, the...

CVE-2026-64346

Summary: CVE-2026-64346 affects the Linux kernel USB gadget udc path. A race condition can occur when the udc (managing gadget state) is freed by usb_del_gadget() while gadget_match_driver() may still access the freed udc (e.g., via configfs). This Use-After-Free can trigger a NULL pointer derefe...

CVE-2026-64346 usb: gadget: udc: Fix use-after-free in gadget_match_driver

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

EUVD-2026-48890

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64346 usb: gadget: udc: Fix use-after-free in gadget_match_driver

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

CVE-2026-64346

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: Fix use-after-free in gadgetmatchdriver The udc structure acts as the management structure for the gadget, but their lifecycles are decoupled. A race condition exists where usbdelgadget frees the udc memory e.g....

EUVD-2026-48888

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

CVE-2026-64344 USB: idmouse: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: idmouse: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a...

CVE-2026-64344

CVE-2026-64344 tracks a Linux kernel USB idmouse driver use‑after‑free on disconnect race. The root cause: mutex_unlock() may touch the mutex after unlocking, risking lifetime management problems; the fix uses a kref to release driver data to avoid use‑after‑free when release() races with disconn...

CVE-2026-64343 USB: ldusb: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

EUVD-2026-48887

In the Linux kernel, the following vulnerability has been resolved: USB: ldusb: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use a kr...

CVE-2026-64341 USB: iowarrior: fix use-after-free on disconnect race

In the Linux kernel, the following vulnerability has been resolved: USB: iowarrior: fix use-after-free on disconnect race mutexunlock may access the mutex structure after releasing the lock and therefore cannot be used to manage lifetime of objects directly unlike spinlocks and refcounts. 12 Use ...