EUVD-2026-86217

In the Linux kernel, the following vulnerability has been resolved: exfat: fix handling of damaged volume in exfatcreateupcasetable When the size of the upcase table is set to zero in the dentry for any reasone.g. corrupted media or misbehaving device, an integer overflow causes the module to loo...

EUVD-2026-86216

In the Linux kernel, the following vulnerability has been resolved: virtio-fs: avoid double-free on failed queue setup virtiofssetupvqs allocates fs-vqs and fs-mqmap before calling virtiofindvqs. If virtiofindvqs fails, the error path frees both pointers and returns an error to virtiofsprobe...

EUVD-2026-86215

In the Linux kernel, the following vulnerability has been resolved: HID: hidpp: fix potential UAF in hidppconnectevent If inputregisterdevice fails, we call inputfreedevice, but keep stale pointer to the old device in hidpp-input, which could potentially lead to UAF. Fix that by resetting it to...

EUVD-2026-86214

In the Linux kernel, the following vulnerability has been resolved: spi: Add NULL check for spigetdeviceid in spigetdevicematchdata Prevent NULL pointer dereference when spigetdeviceid returns NULL, which can happen when using driveroverride without matching SPI ID entry...

EUVD-2026-86213

In the Linux kernel, the following vulnerability has been resolved: tls: reject the combination of TLS and sockmap TLS and sockmap BPF psock integration hides a lot of latent bugs. Bugs which may be more or less relevant for real users but they are definitely exploitable. We could not find anyone...

EUVD-2026-86212

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Let driver decide buffer size at AMDKFDIOCGETDMABUFINFO ioctl amdkfd driver needs allocate buffer to return bo metadata to user space. The buffer size is controlled by user currently. It is a potential security issue...

EUVD-2026-86210

An out-of-bounds read in libXi's XI2 class parsing via sizeclasses and copyclasses in libXi before 1.8.4 could be used by malicous servers to crash the X client...

EUVD-2026-86211

In the Linux kernel, the following vulnerability has been resolved: PCI: iproc: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead ...

EUVD-2026-86209

In the Linux kernel, the following vulnerability has been resolved: PCI: altera: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead...

EUVD-2026-86208

In the Linux kernel, the following vulnerability has been resolved: PCI: rockchip: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

EUVD-2026-86207

In the Linux kernel, the following vulnerability has been resolved: PCI: mediatek: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may le...

EUVD-2026-86206

In the Linux kernel, the following vulnerability has been resolved: PCI: plda: Protect root bus removal with rescan lock Hold the pcirescanremovelock lock while stopping and removing a root bus to avoid racing with concurrent rescan or hotplug operations triggered via sysfs. Such races may lead t...

EUVD-2026-86205

In the Linux kernel, the following vulnerability has been resolved: perf: Fix addrfilterranges lifetime Lee Jia Jie reported that since event::addrfilterranges is used under RCU, it should be RCU freed...

EUVD-2026-86204

In the Linux kernel, the following vulnerability has been resolved: f2fs: validate inline dentry name lengths before conversion Inline dentry conversion copies names out of the inline dentry area before checking that each recorded name length fits in the available filename slots. A corrupted imag...

EUVD-2026-86203

In the Linux kernel, the following vulnerability has been resolved: net: au1000: move freeirq out of the close-time spinlocked section au1000close calls freeirq while aup-lock is still held with spinlockirqsave. freeirq can sleep because it takes the IRQ descriptor request mutex, so it does not...

EUVD-2026-86202

In the Linux kernel, the following vulnerability has been resolved: spi: core: Abort active target transfer on controller suspend When an SPI controller operating in target mode has a transfer in progress at the time of system suspend, the suspend path proceeds without aborting the ongoing...

EUVD-2026-86201

In the Linux kernel, the following vulnerability has been resolved: btrfs: tree-checker: validate INODEREF's namelen BUG A crafted btrfs image can trigger the following crash: BUG: unable to handle page fault for address: ffffd1dc42884000 PF: supervisor write access in kernel mode PF:...

EUVD-2026-86200

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix sdndr.data memory leak in ksmbdvfssetsdxattr ndrencodev4ntacl allocates sdndr.data via kzalloc at entry. If any subsequent ndrwrite call returns error during encoding, the allocated sdndr.data won't be freed and causes...

EUVD-2026-86199

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 2.5.0 until 2.5.1, the /homepage/proxy endpoint accepts an authenticated user's url query parameter and passes it to http.get or https.get without destination restrictions. In...

EUVD-2026-86198

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Fix acl.sdbuf memory leak and invalid sdsize error handling 1. When ndrdecodev4ntacl fails, the code jumped to freendata which only freed n.data, skipping kfreeacl.sdbuf and leaking the buffer. Zero-initialize struct...

EUVD-2026-86197

In the Linux kernel, the following vulnerability has been resolved: cachefiles: Fix double fput Fix a double fput in error handling in cachefilescreatetmpfile...

EUVD-2026-86196

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: flush pending RCU callbacks on module unload Call rcubarrier in module exit to wait for outstanding callrcu callbacks before freeing module text, preventing late callback execution in freed memory. BUG: unable to hand...

EUVD-2026-86195

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usbep1commandreplydispatch uses buf0 as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf1, buf2, or buf + 3...

EUVD-2026-86194

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers rsihalloadkey copies txmickey and rxmickey from data16 and data24 whenever key data is present. Those offsets are only part of the 32-byte TKIP key layout. Shorter keys...

EUVD-2026-86193

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate assoc response length before status and IE access cfg80211rxassocresp initialises the status and response-IE fields of cfg80211connectrespparams from the management frame before proving that the frame is...

EUVD-2026-86192

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate rx/tx MLME callback frame lengths before access cfg80211rxmlmemgmt and cfg80211txmlmemgmt call tracepoints before rejecting frames shorter than the frame-control field. After that, they only require len =...

EUVD-2026-86191

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: ibss: wait for in-flight TX on disconnect While leaving an IBSS in ieee80211ibssdisconnect mac80211 flushes stations, turns the carrier off and immediately tells the driver to leave as well. While there may be...

EUVD-2026-86190

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: fix key index receive bound checks libipwrx reads skb-datahdrlen + 3 to extract the WEP key index in both the software-decrypt key selection path and the hardware-decrypted IV/ICV strip path. In both places the...

EUVD-2026-86189

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: validate beacon length before fixed buffer copy rsipreparebeacon copies the mac80211 beacon frame after FRAMEDESCSZ into a management skb whose usable tailroom may be smaller than MAXMGMTPKTSIZE after alignment. Valida...

EUVD-2026-86188

In the Linux kernel, the following vulnerability has been resolved: smb/client: zero-initialize stack-allocated cifsopeninfodata Stack-allocated cifsopeninfodata may contain random data. This can make some fields have wrong value if they are not set later...

EUVD-2026-86187

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix use-after-free on reloc root after error in insertdirtysubvol If during relocation we fail in insertdirtysubvol because btrfsupdaterelocroot returned an error, we will leave a root's relocroot field pointing to a reloc...

EUVD-2026-86186

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate staid in BA window status notif BAWINDOWSTATUSNOTIFICATIONID extracts a 5-bit staid from the firmware notification and uses it to index fwidtomacid without bounds checking. Validate staid before array...

EUVD-2026-86185

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix reloc root cleanup in mergerelocroots If the root we got has zero root refs in its root item, we are resetting the root's -relocroot without using barriers like we do everywhere else. Sashiko complained about this whil...

EUVD-2026-86184

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix an off-by-1 boundary check Before looking at the 11th byte, check the length is big enough...

EUVD-2026-86183

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: pcie: null RX pointers after free When iwlpcietxinit fails after RX init, nic init unwinds via iwlpcierxfree. The freed RX members stayed non-NULL on the live transport object, so later teardown or retry could touc...

EUVD-2026-86182

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: fix leaks and online flag on radixtreeinsert failure When radixtreeinsert fails in blkgcreate, the error path has two issues: 1. blkg-online is set to true unconditionally, even when the blkg was never fully inserted...

EUVD-2026-86181

In the Linux kernel, the following vulnerability has been resolved: smb/client: flush dirty data before punching a hole Punching a hole after a large buffered write may leave the range reported as data. Reproduce it with: xfsio -f \ -c "pwrite -b 3m -S 0x61 0 3m" \ -c "fpunch 1m 1m" \ -c "seek -h...

EUVD-2026-86180

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: validate TXCMD response layout TXCMD parsing uses framecount to walk status entries and then read the trailing SCD SSN. Make the minimum-length check follow that exact runtime layout calculation before parsing...

EUVD-2026-86179

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix a possible underflow We shouldn't trust the firmware about the length of the wowlan packet...

EUVD-2026-86178

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: add a check on the tid coming from the firmware banotif-tid is a firmware-controlled u8 that is used directly as an array index into tiddata without any validation. Add a bounds check against IWLMAXTIDCOUNT...

EUVD-2026-86177

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix out-of-bounds tiddata access in BA notif mvmsta-tiddata was indexed by the TFD loop counter 'i' instead of the actual TID value 'tid'. This writes lqcolor into a random tiddata slot unrelated to the BA...

EUVD-2026-86176

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: bound aligned TLV advance in FW parser Validate ALIGNtlvlen, 4 against remaining parser length before consuming bytes from the firmware image. This avoids length underflow on malformed TLVs...

EUVD-2026-86175

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: acpi: validate WGDS table revision index Check tblrev bounds before BITtblrev to avoid undefined shifts when firmware reports an invalid revision value...

EUVD-2026-86174

In the Linux kernel, the following vulnerability has been resolved: smb: client: bound dirent name against end of SMB response in cifsfilldir cifsfilldir copies the entry name out of an SMB1 TRANS2FINDFIRST / FINDNEXT response using a length de.namelen supplied by the server. The kmalloc'd SMB...

EUVD-2026-86173

In the Linux kernel, the following vulnerability has been resolved: ksmbd: preserve VFS inherited POSIX ACL mask The VFS initializes a child's POSIX ACL from the parent's default ACL and the requested creation mode. Do not mutate the parent ACL or overwrite the child's VFS-computed access and...

EUVD-2026-86172

In the Linux kernel, the following vulnerability has been resolved: cifs: validate idmap key payload length The cifs.idmap key type stores its payload length in key-datalen, which is limited to U16MAX. Accepting a larger key payload truncates the recorded length and can make later users interpret...

EUVD-2026-86171

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: validate IEs in cfg80211wextsiwgenie The KASAN allocation trace shows that a malformed IE buffer is stored via SIOCSIWGENIE cfg80211wextsiwgenie without any validation. The crash trace shows that a subsequent...

EUVD-2026-86170

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: validate skb length in rfcommrecvframe rfcommrecvframe casts skb-data to struct rfcommhdr and dereferences hdr-addr and hdr-ctrl without validating skb-len first. A truncated frame with skb-len less than the...

EUVD-2026-86169

In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: flush backend after device ioctls vhost-scsi translates guest response descriptors into userspace iovecs when commands are submitted. Target-core completes those commands asynchronously, so VHOSTSETMEMTABLE can replac...

EUVD-2026-86168

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Do not block on tag allocation in scsiehlockdoor scsiehlockdoor is called from scsirestartoperations while the host is still in the SHOSTRECOVERY state, i.e. before the host is switched back to SHOSTRUNNING and...