CVE-2026-31597

The CVE-2026-31597 vulnerability affects the Linux kernel OCFS2 code. A use-after-free occurs in ocfs2_fault() when VM_FAULT_RETRY triggers after filemap_fault() drops mmap_lock, allowing a concurrent munmap() to free the vm_area_struct and causing ocfs2_fault() to dereference a dangling vma. The...

CVE-2026-23361

CVE-2026-23361 affects the Linux kernel PCIe design (dwc: ep) where a posted MSI-X write may race with ATU unmapping, potentially corrupting host memory or triggering IOMMU errors. The mitigation described in the public description is to flush the write by performing a readl() on the same address...

Astra Linux - уязвимость в linux-6.12

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels up to 6 levels, starting with a 3-level configuration that expands based on IOVA...

PT-2025-53234

In the Linux kernel, the following vulnerability has been resolved: binder: fix UAF of alloc-vma in race with munmap cmllamas: clean forward port from commit 015ac18be7de "binder: fix UAF of alloc-vma in race with munmap" in 5.10 stable. It is needed in mainline after the revert of commit...

CVE-2025-39961 iommu/amd/pgtbl: Fix possible race while increase page table level

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels up to 6 levels, starting with a 3-level configuration that expands based on IOVA...

CVE-2025-39961 iommu/amd/pgtbl: Fix possible race while increase page table level

In the Linux kernel, the following vulnerability has been resolved: iommu/amd/pgtbl: Fix possible race while increase page table level The AMD IOMMU host page table implementation supports dynamic page table levels up to 6 levels, starting with a 3-level configuration that expands based on IOVA...

kernel: unmap_mapping_range() race with munmap() on VM_PFNMAP mappings leads to stale TLB entry

A flaw was found in include/asm-generic/tlb.h in the Linux kernel due to a race condition unmapmappingrange versus munmap. This issue allows a device driver to free a page while it still has stale TLB entries...