CVE-2026-98999 drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Fix stale pinnedlink entry when fb-pin performs the final unpin xebopinexternal and xebounpinexternal maintain the bo's pinnedlink list membership in xe-pinned.late.external, based on whether the current call is the...

CVE-2026-98999

The Linux kernel contains a vulnerability in the drm/xe driver where a buffer object (bo ) can remain linked in the xe->pinned.late.external list indefinitely. This occurs when a bo is pinned both externally (e.g., dma-buf export) and as a framebuffer (fb ); if the external unpin occurs first,...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98995 namespace: reset the old parent's ->overmount in mnt_change_mountpoint()

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98995

The Linux kernel contains a vulnerability in mnt_change_mountpoint() where it fails to reset the ->overmount pointer of an old parent during a mount move, unlike __umount_mnt(). This discrepancy can occur during a reparent() operation where propagate_umount() moves a surviving overmount. If a ...

EUVD-2026-108789

In the Linux kernel, the following vulnerability has been resolved: namespace: reset the old parent's -overmount in mntchangemountpoint umountmnt resets -overmount of the parent when it unmounts the mount that overmounts it. mntchangemountpoint doesn't. It moves the mount to its new parent and...

CVE-2026-98994 statmount: read the parent of an unmounted mount under mount_lock

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98994

The Linux kernel contains a vulnerability where the statmount_mnt_basic() function can dereference a mount that has already been freed. This occurs because the function reads m->mnt_parent twice while holding the mount_lock , allowing a concurrent mntput() operation to unmount children and fre...

CVE-2026-98994 statmount: read the parent of an unmounted mount under mount_lock

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

EUVD-2026-108788

In the Linux kernel, the following vulnerability has been resolved: statmount: read the parent of an unmounted mount under mountlock statmountmntbasic reads the ids of the parent through m-mntparent with namespacesem held for reading. That's fine for a mount that is in a namespace. Everything abo...

CVE-2026-98991 namespace: queue a mount only once for mount notifications

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

EUVD-2026-108785

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-98991 namespace: queue a mount only once for mount notifications

In the Linux kernel, the following vulnerability has been resolved: namespace: queue a mount only once for mount notifications mntnotifyadd puts a mount on notifylist. It doesn't check whether the mount is on the list already. That's fine as long as every mount is queued at most once per...

CVE-2026-98991

A slab-use-after-free vulnerability exists in the Linux kernel due to a flaw in how mount notifications are queued. The mnt_notify_add() function fails to check if a mount is already on the notify_list. Under specific conditions involving propagate_umount(), shrink_submounts(), and mark_mounts_fo...

CVE-2026-98985 namespace: check the mounts before reading their parents in pivot_root()

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

CVE-2026-98985 namespace: check the mounts before reading their parents in pivot_root()

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

CVE-2026-98985

The Linux kernel is affected by a slab-use-after-free vulnerability in the path_pivot_root() function. The issue occurs because the kernel reads the parents of new_root and the caller's root before verifying if the mounts are in the caller's mount namespace. If new_root is a file descriptor to an...

EUVD-2026-108779

In the Linux kernel, the following vulnerability has been resolved: namespace: check the mounts before reading their parents in pivotroot pathpivotroot reads the parents of newroot and of the caller's root and checks whether they are shared before it checks that either mount is in the caller's...

EUVD-2026-108776

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

CVE-2026-98982 namespace: don't let a pseudo dentry become the root of a mount

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...