EUVD-2026-55521

A missing authentication vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to read arbitrary stored documents via the fileupload Parse cloud function. The function mints MASTERKEY-signed file access tokens for any caller-supplied URL without...

EUVD-2026-55519

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

EUVD-2026-55518

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25listlock protects list membership while the lookup is in progress, but it...

EUVD-2026-55517

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

EUVD-2026-55516

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...

EUVD-2026-55515

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

EUVD-2026-55514

In the Linux kernel, the following vulnerability has been resolved: ice: fix PTP Call Trace during PTP release If a PF reset occurs when the PTP state is ICEPTPUNINIT, then iceptprebuild will update the state to ICEPTPERROR. This will result in the following PTP release call trace during driver...

EUVD-2026-55513

In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices dothawallcallback calls bdevthaw while holding sb-sumount exclusively. If the block device was frozen via bdevfreeze dropping the last block layer freeze reference calls...

EUVD-2026-55512

In the Linux kernel, the following vulnerability has been resolved: rbd: Reset positive result codes to zero in object map update path In a reply message to an RBD request, a positive result code indicates a data payload, which is not allowed for writes. While rbdosdreqcallback already resets a...

EUVD-2026-55511

In the Linux kernel, the following vulnerability has been resolved: ksmbd: defer destroyprevioussession until after NTLM authentication In ntlmauthenticate, destroyprevioussession is called using a user pointer resolved from the client-supplied NTLM blob username field before the NTLMv2 response ...

EUVD-2026-55510

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

EUVD-2026-55509

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

EUVD-2026-55508

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

EUVD-2026-55507

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154scanworker captures the scanning sub-interface under RCU and then keeps dereferencing sdata-dev after rcureadunlock and outside the rtnl -- in the failure...

EUVD-2026-55506

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...

EUVD-2026-55505

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

EUVD-2026-55504

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...

EUVD-2026-55503

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

EUVD-2026-55502

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

EUVD-2026-55501

In the Linux kernel, the following vulnerability has been resolved: rtase: Workaround for TX hang caused by hardware packet parsing The hardware performs packet parsing before packet transmission. Parsing incomplete IPv4, IPv6, TCP, or UDP headers may trigger a TX hang because the hardware parser...

EUVD-2026-55500

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

EUVD-2026-55499

In the Linux kernel, the following vulnerability has been resolved: tcp: challenge ACK for non-exact RST in SYN-RECEIVED The SYN-RECEIVED request-socket path in tcpcheckreq accepts an in-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A non-exact RST therefore removes the request...

EUVD-2026-55498

In the Linux kernel, the following vulnerability has been resolved: tipc: clear sock-sk on the failed-insert path in tipcskcreate When tipcskcreate fails to insert the new socket tipcskinsert returns non-zero, its error path frees the sk with skfree but leaves sock-sk pointing at the freed object...

EUVD-2026-55497

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix source list corruption on a failed replace When replacing the source list of an MDB remote entry, all existing sources are first marked for deletion and vxlanmdbremotesrcsadd is then called to add the new source...

EUVD-2026-55496

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx10: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit ac6f00beb658239bced4aaed9efbb04a35348d48...

EUVD-2026-55495

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit e4d99e04b2e9b13b97d3b17804c735f62689db23...

EUVD-2026-55494

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx12: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit f952076f76d62f783e8ba4995a7c400d39354ccf...

EUVD-2026-55493

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9.4.3: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit 5676593d08998d7a6d9e2d51d6b54b3820e3755c...

EUVD-2026-55492

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx9: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit b71604f8685b0eba07866f4e8dc30f93e1931054...

EUVD-2026-55491

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma4.4.2: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit fa4f86a148271e325e95287630a3a15a9cd35fdc...

EUVD-2026-55490

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/sdma7.1: replace BUGON with WARNON There's no need to crash the kernel for these cases. cherry picked from commit c4f230b51cf2d3e7e8b1c800331f3dbed2a9e3f5...

EUVD-2026-55489

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vce: fix integer overflow in image size Fix a security vulnerability where malicious VCE command streams with oversized dimensions e.g. 65536×65536 cause 32-bit integer overflow, wrapping the calculated buffer size to ...

EUVD-2026-55488

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/vcn4: avoid rereading IB param length Reuse the parameter length returned by vcnv40encfindibparam instead of rereading it from the IB. This avoids a potential TOCTOU issue if the IB contents change between reads. cherr...

EUVD-2026-55487

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix division by zero with invalid uvd dimensions When width or height is less than 16, widthinmb or heightinmb becomes 0, leading to fsinmb being 0. This causes a division by zero when calculating numdpbbuffer in H264...

EUVD-2026-55486

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix kernel panic during driver load failure Avoid kernel panic if MES init fails during driver load. The KIQ ring is falsely marked as ready as ASICs that use MES, KIQ is owned by MES. BUG: kernel NULL pointer...

EUVD-2026-55485

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: invoke pmgenpdremove before freeing genpd Call pmgenpdremove to unregister from global list prior to releasing acpgenpd memory, and clear the pointer after free. cherry picked from commit...

EUVD-2026-55484

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: reject mapping a reserved doorbell to a new queue When creating an user-queue, the user space provides a doorbell BO handle and an offset within the bo to obtain a doorbell. However current implementation using...

EUVD-2026-55483

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix aperture mapping leak amdgpupciremove calls drmdevunplug before invoking the driver fini routines. This causes drmdeventer in amdgputtmfini to always return false, so iounmapaperbasekaddr never runs on normal driv...

EUVD-2026-55482

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix check in amdgpuhmminvalidategfx For a short moment during alloc/free the userptr BO is not part of his VM, so bo-vmbo can be NULL. Keep a reference to the VM root PD as parent of the userptr BO so that we can alwa...

EUVD-2026-55481

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate numsubauth when copying ACE in setntacldacl setntacldacl copies each ACE from the attacker-controlled stored security descriptor verbatim into the response DACL without checking sid.numsubauth. The ACE bytes...

EUVD-2026-55480

In the Linux kernel, the following vulnerability has been resolved: ksmbd: restore DACL size on checkaddoverflow to avoid malformed ACL checkaddoverflow unconditionally writes the truncated sum into d even on overflow, per its contract in include/linux/overflow.h. The four checkaddoverflow guards...

EUVD-2026-55479

In the Linux kernel, the following vulnerability has been resolved: ksmbd: bound DACL dedup walk to copied ACEs setntacldacl can stop copying ACEs before consuming the full input DACL when size accounting overflows. When that happens, numaces reflects only the ACEs that were actually copied into...

EUVD-2026-55478

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

EUVD-2026-55477

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in auditdupeexe A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved e.g., via dorenameat2, the VFS layer locks the parent directory...

EUVD-2026-55476

In the Linux kernel, the following vulnerability has been resolved: fuse-uring: fix race between registration and connection abortion This fixes this race: - thread a: iouringenter - register sqe - fuseuringcreateringent - allocate ent but doesn't grab queueref yet - thread b: fuseconndestroy -...

EUVD-2026-55475

In the Linux kernel, the following vulnerability has been resolved: schedext: Preserve rq tracking across local DSQ dispatch dispatchtolocaldsq can run from scxbpfdsqmovetolocal while ops.dispatch has recorded the current rq. Moving a task to a local DSQ may switch to the source or destination rq...

EUVD-2026-55474

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Bump asidgeneration on CPU online to avoid ASID collision after hotplug If a vCPU stays scheduled out or blocked while the last pCPU it ran on goes through a hotplug cycle online-offline-online, and the vCPU then resume...

EUVD-2026-55273

In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before usage Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksour...

EUVD-2026-55272

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...

EUVD-2026-55271

In the Linux kernel, the following vulnerability has been resolved: debugobjects: Plug race against a concurrent OOM disable syzbot reported a puzzling splat: WARNING: kernel/time/hrtimer.c:443 at stubtimer+0xa/0x20 stubtimer is installed as timer callback function in hrtimerfixupassertinit, whic...