EUVD-2026-86910

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

EUVD-2026-86909

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstdgetworkspace even though a workspace is free. When zstdallocworkspace fails, the task is queued on zwsm-wait and schedules unconditionall...

EUVD-2026-86908

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

EUVD-2026-86906

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

EUVD-2026-86907

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

EUVD-2026-86905

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

EUVD-2026-86726

In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in devchangenetnamespace. syzbot reported the warning in cfg80211pernetexit. 0 The repro does the following: 1. create two device in root netns and non-root netns 2. assign the sam...

EUVD-2026-86727

In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curractiveslave prematurely when releasing all slaves When releasing all slaves during bond destruction all == true, bondreleaseone unconditionally clears bond-curractiveslave to NULL in every iteration. If ...

EUVD-2026-86725

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

EUVD-2026-86724

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

EUVD-2026-86723

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

EUVD-2026-86721

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

EUVD-2026-86722

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

EUVD-2026-86720

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

EUVD-2026-86719

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Fix potential double-free at error path The fix for caiaq driver's resource management to handle the errors tries to release the resources in a common destructor call, but as a sashiko review for another patch...

EUVD-2026-86718

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

EUVD-2026-86716

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref in btfvarshow btfvarshow calls btftypeidresolve unconditionally, which dereferences btf-resolvedids. That is NULL for a base BTF - e.g. the vmlinux BTF that bpfsnprintfbtf renders against - since base BTF ...

EUVD-2026-86717

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix NULL-ptr-deref when showing a void BTF type btfmodifiershow resolves the modifier and then calls btftypeopst-show unconditionally. For the void type typeid 0, BTFKINDUNKN kindops has no entry, so -show is NULL. A "const...

EUVD-2026-86715

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

EUVD-2026-86714

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

EUVD-2026-86713

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

EUVD-2026-86711

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

EUVD-2026-86712

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

EUVD-2026-86710

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

EUVD-2026-86709

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

EUVD-2026-86708

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails sndhdacextbusgetmlcapabilities may fail and its return code shall be checked and accounted for. Address the issue by updating the error-path for avspciprobe. At the...

EUVD-2026-86706

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix initconfig access Existing code accesses enties found in -initconfigs array through indexes that are part of -configids array. Those two are limited by: -numinitconfigs and -numconfigids...

EUVD-2026-86707

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

EUVD-2026-86705

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

EUVD-2026-86703

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

EUVD-2026-86704

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

EUVD-2026-86702

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

EUVD-2026-86700

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

EUVD-2026-86701

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

EUVD-2026-86699

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

EUVD-2026-86698

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

EUVD-2026-86697

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

EUVD-2026-86695

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collectlinkedregs checkcondjmpop copies the compared registers into env-false,truereg1,2 before collectlinkedregs runs and copies those snapshots back into both branch states afterwards...

EUVD-2026-86696

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

EUVD-2026-86693

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

EUVD-2026-86694

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...

EUVD-2026-86692

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

EUVD-2026-86690

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

EUVD-2026-86691

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcountacquire nullable for borrowed RCU kptrs bpfrefcountacquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KFRETNULL on the return value...

EUVD-2026-86689

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve special fields in recycled rhtab elements rhtabmapupdateelem initializes special fields after obtaining an element from bpfmemcachealloc. The allocator can return a fresh, zeroed unit, or recycle one from its...

EUVD-2026-86688

In the Linux kernel, the following vulnerability has been resolved: bpf: Cancel special fields when recycling rhtab elements rhtabmapupdateexisting and rhtabdeleteelem call bpfobjfreefields when replacing or deleting a value. These map operations can run from BPF programs in NMI context, where...

EUVD-2026-86687

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark NULL kptr stores precise checkmapkptraccess permits a scalar store into an untrusted kptr field only when the register is known to contain zero. Unlike other verifier checks whose outcome depends on a scalar value, it...

EUVD-2026-86686

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve inner map identity in callback frames Callback frame constructors initialize map-typed argument registers with markregknownzero and then restore mapptr. This clears mapuid, which is the only field distinguishing inn...

EUVD-2026-86685

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage to handle t...

EUVD-2026-86684

In the Linux kernel, the following vulnerability has been resolved: nexthop: Initialize extack in removenhgrpentry removenhgrpentry prints the extack message when a listener fails to replace the reduced nexthop group. However, extack is not initialized and listeners are not required to set a...