CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681

CVE-2026-10681 overview (Zephyr) : In the userspace dynamic-objects subsystem, thread_idx_alloc() reads and clears the global _thread_idx_map[] bitmap without holding lists_lock. On SMP systems, concurrent k_object_alloc(K_OBJ_THREAD) calls can observe the same free bit, perform a non-atomic RMW,...

CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-10681 SMP race in `thread_idx_alloc()` lets concurrent `k_object_alloc(K_OBJ_THREAD)` callers share a kernel-object permission slot

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

EUVD-2026-49045

In Zephyr's userspace dynamic-objects subsystem, threadidxalloc in kernel/userspace/userspace.c allocated a new thread permission index from the global threadidxmap bitmap without holding listslock. On SMP systems, two user-mode threads invoking the kobjectallocKOBJTHREAD syscall concurrently can...

CVE-2026-64262

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...

CVE-2026-64263

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix moving cancelled entry to entinuserspace list fuseuringcancel moves entries that are available these have no reqs attached to the entinuserspace list. entlistrequestexpired checks the first entry on entinuserspace...

CVE-2026-64258

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: remove request-less entries from entwreqqueue to fix NULL deref If a copy into the userspace ring buffer fails, a request will be terminated and fuseuringreqend will set ent-fusereq to NULL but it will leave the entry...

CVE-2026-64284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

UBUNTU-CVE-2026-64327

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

UBUNTU-CVE-2026-64284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

EUVD-2026-48871

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

CVE-2026-64327

CVE-2026-64327 affects the Linux kernel USB gadget f_fs (FunctionFS) component. The root cause is that epfile->in was only initialized in ffs_func_eps_enable() (triggered on USB host connection), so early userspace ioctls such as FUNCTIONFS_DMABUF_ATTACH executed before host connection would o...

CVE-2026-64327 usb: gadget: f_fs: Initialize epfile->in early to fix endpoint direction checks

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Initialize epfile-in early to fix endpoint direction checks When parsing endpoint descriptors, ffsdatagotdescs generates the epsaddrmap which contains the endpoint direction. However, epfile-in was previously on...

EUVD-2026-48996

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

CVE-2026-64284

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

CVE-2026-64284 KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace exits Move the handling of fastpath userspace exits into vendor code to ensure KVM runs vendor specific operations that need to run before userspace gains...

CVE-2026-64284

CVE-2026-64284 — Linux kernel (KVM/x86): The vulnerability involves moving the handling of fastpath userspace exits into vendor code so KVM can run vendor-specific operations before userspace gains control of the vCPU. The description notes that, for VMX (and soon SVM), KVM must flush the PML buf...

EUVD-2026-48992

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afudmamapregion afuioctldmamap accepts a 64-bit length from userspace via DFLFPGAPORTDMAMAP ioctl without an upper bound check. The value is passed to afudmapinpages where npages is...