CVE-2026-64429 gpio: eic-sprd: use raw_spinlock_t in the irq startup path

In the Linux kernel, the following vulnerability has been resolved: gpio: eic-sprd: use rawspinlockt in the irq startup path sprdeicirqunmask enables the GPIO IRQ and then updates controller state through sprdeicupdate, which takes sprdeic-lock with spinlockirqsave. The callback can be reached fr...

CVE-2026-64424 netpoll: fix a use-after-free on shutdown path

In the Linux kernel, the following vulnerability has been resolved: netpoll: fix a use-after-free on shutdown path There is a use-after-free error on netpoll, which is clearly detected by KASAN. BUG: KASAN: slab-use-after-free in rawspinlockirqsave+0x3b/0x80 Read of size 1 at addr ... by task...

CVE-2026-64424

CVE-2026-64424 is a use-after-free in the Linux kernel's netpoll subsystem on the shutdown path. When __netpoll_cleanup() runs, it schedules an RCU callback that calls kfree(npinfo), but the TX worker (queue_process) is only cancelled via cancel_delayed_work(), which does not guarantee the worker...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...

CVE-2026-64419 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

CVE-2026-64419 mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

CVE-2026-64419

CVE-2026-64419 is a Linux kernel vulnerability in the mm/shrinker subsystem. The function shrinker_debugfs_count_show() invokes a shrinker's ->count_objects() callback while holding an RCU read-side lock . The zswap shrinker's callback flushes memcg statistics via css_rstat_flush(), which may ...

EUVD-2026-48963

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

CVE-2026-64389 ksmbd: validate NTLMv2 response before updating session key

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate NTLMv2 response before updating session key ksmbdauthntlmv2 derives the NTLMv2 session key into sess-sesskey before it verifies the NTLMv2 response. ksmbddecodentlmsspauthblob then continues into KEYXCH even when...

CVE-2026-64375

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375 proc: protect ptrace_may_access() with exec_update_lock (FD links)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64375

In CVE-2026-64375, the Linux kernel fix addresses a race in ptrace access checks. Previously proc_pid_get_link() and proc_pid_readlink() looked up the task from the pid twice (before and after the check). The patch passes the task to the ->proc_get_link() handler and adds call_proc_get_link() ...

EUVD-2026-48919

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock FD links procpidgetlink and procpidreadlink currently look up the task from the pid once, then do the ptrace access check on that task, then look up the task from the pid a second...

CVE-2026-64371

CVE-2026-64371 is a race condition in the Linux kernel procfs subsystem where several functions call ptrace_may_access() without exec_update_lock protection. The affected functions include do_task_stat(), proc_pid_wchan(), proc_map_files_lookup(), proc_map_files_readdir(), proc_ns_get_link(), and...

CVE-2026-64371 proc: protect ptrace_may_access() with exec_update_lock (part 1)

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

CVE-2026-64371

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

EUVD-2026-48915

In the Linux kernel, the following vulnerability has been resolved: proc: protect ptracemayaccess with execupdatelock part 1 Fix the easy cases where procfs currently calls ptracemayaccess without execupdatelock protection, where the fix is to simply add the extra lock or use mmaccess: -...

EUVD-2026-48896

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

CVE-2026-64352

CVE-2026-64352 affects the Linux kernel BPF subsystem , specifically the LPM (Longest Prefix Match) trie implementation in kernel/bpf/lpm_trie.c. The root cause is incorrect RCU lock annotations : trie_lookup_elem() used rcu_read_lock_bh_held() which does not accept the Tasks Trace RCU held by sl...