CVE-2026-64046

In the Linux kernel, the following vulnerability has been resolved: net: tls: prevent chain-after-chain in plain text SG Sashiko points out that if end = 0 start != 0 the current code will create a chain link to content type right after the wrap link: This would create a chain where the wrap link...

CVE-2026-64042

In the Linux kernel, the following vulnerability has been resolved: vfio/pci: Check BAR resources before exporting a DMABUF A DMABUF exports access to BAR resources and, although they are requested at startup time, we need to ensure they really were reserved before exporting. Otherwise, it's...

CVE-2026-64117

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...

CVE-2026-64058

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix netfsreadfolio to wait on writeback Fix netfsreadfolio to wait for an ongoing writeback to complete so that it can trust the dirty flag and whatever is attached to folio-private folio-private may get cleaned up by the...

CVE-2026-64059

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix folio-private handling in netfsperformwrite Under some circumstances, netfsperformwrite doesn't correctly manipulate folio-private between NULL, NETFSFOLIOCOPYTOCACHE, pointing to a group and pointing to a netfsfolio...

CVE-2026-64065

In the Linux kernel, the following vulnerability has been resolved: netfs: fix VMBUGONFOLIO issue in netfswritebegin call The multiple runs of generic/013 test-case is capable to reproduce a kernel BUG at mm/filemap.c:1504 with probability of 30%. while true; do sudo ./check generic/013 done...

CVE-2026-64067

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing barriers when accessing stream-subrequests locklessly The list of subrequests attached to stream-subrequests is accessed without locks by netfscollectreadresults and netfscollectwriteresults, and then they acce...

CVE-2026-64186

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommummiowrite and iommucapabilitywrite, the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser. If ...

CVE-2026-64105

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Free privateirqs when init fails after allocation Companion to commit 250f25367b58 "KVM: arm64: Tear down vGIC on failed vCPU creation", which added the missing kvmvgicvcpudestroy call to the kvmsharehyp failure...

CVE-2026-63911

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfsclonestate clones the IPTFS mode data with kmemdup. This copies runtime objects which must not be shared with the original SA, including the embedded skbuffhead, hrtimers,...

CVE-2026-63916

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-63840

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.3.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 86ac011ae234c03fb872f4945913391ea1d8862e...

CVE-2026-63841

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.1 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 742a98e2e81702df8fe1b1eccee5223220a03dc2...

CVE-2026-63842

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/jpeg: set nouserfence for JPEG v5.0.0 ring JPEG rings do not support 64-bit user fence writes, reject CS submissions with user fences. cherry picked from commit 0f43893d3cd478fa57836697525b338817c9c23d...

CVE-2026-63963

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: validate VDO count in Discover Identity ACK handlers Properly validate the count passed from a device when calling svdmconsumeidentity or svdmconsumeidentitysopprime as the device-controlled value could index of...

CVE-2026-64008

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-64171

In the Linux kernel, the following vulnerability has been resolved: i2c: tegra: fix pmruntime leak on mutexlock failure If tegrai2cmutexlock fails, the function returns without calling pmruntimeput, leaking the runtime PM reference acquired by the preceding pmruntimegetsync. This prevents the...

CVE-2026-64079

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtables: allocate hook ops while under mutex arp/ip6tregistertable add the table to the per-netns list via xtregistertable before allocating the per-netns hook ops copy via kmemduparray. This leaves a window where the...

CVE-2026-64162

In the Linux kernel, the following vulnerability has been resolved: idpf: fix readdevclklock spinlock init in idpfptpinit In idpfptpinit, readdevclklock is initialized after ptpscheduleworker had already been called and after idpfptpsettime64 could reach the lock. The PTP aux worker fires...

CVE-2026-64164

In the Linux kernel, the following vulnerability has been resolved: btrfs: tracepoints: fix sleep while in atomic context in btrfssyncfile The trace event btrfssyncfile is called in an atomic context all trace events are and its call to dput, which is needed due to the call to dgetparent, can...