EUVD-2026-82203

In the Linux kernel, the following vulnerability has been resolved: hfsplus: validate thread record before delete key rebuild hfsplusdeletecat is called with str == NULL when the last open reference to an unlinked HFS+ hardlink backing inode is closed. In that case, the function finds the catalog...

EUVD-2026-82202

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix dplinkpeer dangling references on AP vdev rollback ath12kmacvdevcreate for an AP vdev creates the bss self-peer via ath12kpeercreate, which finishes by calling ath12kdplinkpeerassign to publish the dplinkpeer in...

EUVD-2026-82201

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailboxchansetup registers the mailbox client with mboxrequestchannel, and the mailbox controller...

EUVD-2026-82200

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unregister device notifier before IDR teardown The requested-devices notifier looks up protocol fwnodes from the activeprotocols IDR. During remove, unregister the notifier before releasing and destroying...

EUVD-2026-82199

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Quiesce notifications before teardown scminotificationexit clears and releases the notification instance, but transport callbacks can still deliver incoming notifications until the TX/RX channels are freed...

EUVD-2026-82198

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Clean up channels on setup failure scmichannelssetup can fail after the common BASE channel or earlier protocol channels have already been registered in the TX/RX IDRs. Route this failure through the existing...

EUVD-2026-82196

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Avoid IDR updates while cleaning channels scmicleanupchannels walks the TX/RX channel IDRs with idrforeach to free transport resources and destroy the dedicated transport devices before calling idrdestroy. The...

EUVD-2026-82197

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Free transport channel on IDR failure If transport channel setup succeeds but the following IDR insertion fails, the error path destroys the transport device and frees the channel info without invoking the...

EUVD-2026-82195

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Reject out of range DT protocol IDs SCMI protocol IDs carried in message headers are limited by MSGPROTOCOLIDMASK. The DT parsing paths noticed protocol IDs outside that range, but only logged an error and then...

EUVD-2026-82194

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Drop handle on protocol bind failures The SCMI bus notifier acquires an SCMI handle when the driver core emits BUSNOTIFYBINDDRIVER, before invoking the protocol driver probe callback. The protocol probe path on...

EUVD-2026-82193

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind TX receiver mailbox setup failure mailboxchansetup can request an additional unidirectional TX receiver channel after successfully acquiring the primary channel. If that second request fails, the functio...

EUVD-2026-82192

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Unwind P2A receiver mailbox setup failure mailboxchansetup can request an additional P2A receiver channel after successfully acquiring the primary P2A channel. If that later request fails, the function returns...

EUVD-2026-82190

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix transport device teardown lookup SCMI transport devices are deliberately excluded from normal SCMI bus matching so protocol drivers cannot bind to the internal transport children. However, scmidevicedestroy...

EUVD-2026-82191

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Fix SCMI device destroy lifetimes scmichilddevfind drops the reference returned by devicefindchild before returning the scmidevice pointer. A concurrent unregister can then release the device while the destroy...

EUVD-2026-82189

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Get Feature count larger than the output buffer cxlctlgetfeature sizes its output buffer from the user's fwctlrpc.outlen, but the device is told to write cxlmboxgetfeatin.count bytes into rpcout-payload, whic...

EUVD-2026-82187

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Clamp Get Feature output size to the remaining buffer cxlgetfeature reads a feature in a loop but passes a fixed sizeout as the output capacity every iteration. On the last partial iteration the buffer has less room...

EUVD-2026-82188

In the Linux kernel, the following vulnerability has been resolved: cxl/features: Reject Set Features output buffer smaller than the header cxlctlsetfeature sizes its output buffer from the user's fwctlrpc.outlen but never checks it is large enough to hold even the fwctlrpccxlout header. With...

EUVD-2026-82186

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear vmemmapshift when binding static pgmap Clear pgmap-vmemmapshift for static DAX devices. When rebinding a static device from devicedax which may set vmemmapshift based on alignment to fsdevdax, the stale...

EUVD-2026-82184

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: use vaphys for kaddr in directaccess Use vaphys instead of virtaddr + linearoffset for the kaddr return in fsdevdaxdirectaccess. The previous code added a device-linear byte offset to virtaddr which is va of ranges0, b...

EUVD-2026-82185

In the Linux kernel, the following vulnerability has been resolved: dax/fsdev: clear pgmap ops and owner on unbind fsdevdaxprobe sets pgmap-ops = &fsdevpagemapops and pgmap-owner = devdax, but nothing ever clears them. For a dynamic device the pgmap is devm-allocated and freed on unbind, so this ...

EUVD-2026-82183

In the Linux kernel, the following vulnerability has been resolved: dax: read holderops once in daxholdernotifyfailure daxholdernotifyfailure reads daxdev-holderops twice without READONCE -- once for the NULL check and once for the indirect notifyfailure call. A concurrent fsputdax can clear...

EUVD-2026-82182

In the Linux kernel, the following vulnerability has been resolved: irqchip/renesas-irqc: Fix generic interrupt chip leak on remove The driver allocates domain generic chips probe. However, on driver removal, the generic chips are not automatically freed when the interrupt domain is removed becau...

EUVD-2026-82181

In the Linux kernel, the following vulnerability has been resolved: media: bcm2835-unicam: Fix asc leaked in error/remove path v4l2asyncnfaddfwnoderemote allocates the asc, which is freed when v4l2asyncnfcleanup is called. Call v4l2asyncnfcleanup properly in the driver paths. Discovered with...

EUVD-2026-82180

In the Linux kernel, the following vulnerability has been resolved: media: ipu6: Do not free aux device pdata after init ipu6businitializedevice stores the isys/psys pdata pointer in struct ipu6busdevice and initializes the auxiliary device. After that point, error unwinding must drop the auxilia...

EUVD-2026-82179

In the Linux kernel, the following vulnerability has been resolved: OPP: Fix cleanup ordering Commit 173e02d67494 "OPP: Initialize scope-based pointers inline" added initialization for all pointers. In some cases, the ordering was changed so that opptable was initialized after opp. This also...

EUVD-2026-82178

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix DM I2C teardown race DM I2C adapters can remain visible to userspace while DM teardown is already in progress. A concurrent i2c-dev transfer may then enter amdgpudmi2cxfer after the backing DM state has been...

EUVD-2026-82177

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: tc358767: clamp the reported AUX read size to the request tcauxtransfer clamps an AUX read to the payload limit: sizet size = mintsizet, DPAUXMAXPAYLOADBYTES - 1, msg-size; After the transfer it replaces size with the...

EUVD-2026-82176

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Take cpalock around large-page collapse Loading and unloading modules concurrently on several CPUs on a KASAN build, with a short delay injected at the CPA page-table lookup to widen the window, faults within minutes:...

EUVD-2026-82175

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: fix counter type in iwlfwrtdumperrorlogs The loop counter 'count' was declared as u8 while numpc is u32. If firmware advertises more than 255 PC entries the counter wraps back to zero and the loop never terminates...

EUVD-2026-82174

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix off-by-one in TXF key sanitiser iwlmvmfrobtxfkeyiter tracks the last matched byte position in loop variable 'i'. When a full key match is found match == keylen, 'i' points at the last byte of the matched...

EUVD-2026-82173

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mei: check SAP message length before reading it Verify the SAP message size is not larger than the local buffer before reading the message to avoid buffer overflow...

EUVD-2026-82172

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: guard against division by zero in iwldbgtlvallocfragments Make sure we don't end-up with a numfrags = 0 situation. For that, check that the required size is not 0 and put a checker on numfrags as well...

EUVD-2026-82171

In the Linux kernel, the following vulnerability has been resolved: gpu: host1x: Avoid stack over-read in debug output helpers host1xdebugoutput and host1xdebugcont used vsnprintf, which returns the length the formatted string would have reached with an unbounded buffer. That return value was...

EUVD-2026-82170

In the Linux kernel, the following vulnerability has been resolved: drm/msm/adreno: fix use after free on error path in a6xxgpuinit The a6xxdestroy function frees "a6xxgpu" and so "adrenogpu" points to freed memory. Preserve the error code before freeing the memory to avoid a use after free...

EUVD-2026-82169

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Fix taskstruct reference leak in recoverworker getpidtask increments the task reference count, but the corresponding puttaskstruct was missing in the else branch, leaking a reference on every GPU hang recovery. Patchwork...

EUVD-2026-82168

In the Linux kernel, the following vulnerability has been resolved: drm/msm: Only fini scheduler after successful init msmringbuffernew destroys a partially initialized ring through msmringbufferdestroy when an allocation or scheduler setup step fails. If drmschedinit fails before it finishes...

EUVD-2026-82167

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Avoid possible memory reclaim deadlock in TX EQTR context TX EQTR may run while devfreq gear scaling has quiesced the UFS tagset. In that context, functions ufshcdtxeqtr, ufshcdtxeqtr and ufsqcomgetrxfom allocate...

EUVD-2026-82166

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: remove broken string configfs attributes The UAC1STRATTRIBUTE macro defines configfs show/store handlers for the fnplay, fncap, and fncntl string options. The store function contains an inverted null che...

EUVD-2026-82164

In the Linux kernel, the following vulnerability has been resolved: uio: Fix stale info pointer in failed registration path After deviceadd, the UIO device is visible to userspace and /dev/uioX can be opened. If a later setup step fails, uioregisterdevice unwinds the device but leaves idev-info...

EUVD-2026-82165

In the Linux kernel, the following vulnerability has been resolved: UDF symlink pathComponent header OOB read udfsymlinkfiller can enter udfpctochar with a partial pathComponent header. Validate that enough input remains for a complete pathComponent header before accessing it. Reject malformed...

EUVD-2026-82163

In the Linux kernel, the following vulnerability has been resolved: speakup: keyhelp: guard letteroffsets possible out-of-range indexing helpinit builds letteroffsets by using the first byte of each function name as an index via start & 31 - 1. If functionnames are overridden from sysfs root with...

EUVD-2026-82162

In the Linux kernel, the following vulnerability has been resolved: misc: bcm-vk: Use acquire/release for msgqinited bcmvksyncmsgq fills the message queue information and then sets msgqinited. Readers call bcmvkdrvaccessok before accessing the message queues and their cached queue information...

EUVD-2026-82161

In the Linux kernel, the following vulnerability has been resolved: misc: ad525xdpot: use driver core groups for sysfs files addpotprobe creates per-RDAC sysfs files manually and then optionally creates the command sysfs group. This leaves probe responsible for rolling back partial sysfs state an...

EUVD-2026-82160

In the Linux kernel, the following vulnerability has been resolved: ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove Three issues arise when the device is removed while a tty session is still active: 1. UAF of struct ipoctal: the remove callback frees ipoctal via...

EUVD-2026-82158

In the Linux kernel, the following vulnerability has been resolved: mtd: part: reject MTDPARTOFSRETAIN in mtdaddpartition mtdaddpartition does not reject the special offset value MTDPARTOFSRETAIN -3, which leads to a WARNON in addmtddevice when called through the BLKPG ioctl on NAND devices. The...

EUVD-2026-82159

In the Linux kernel, the following vulnerability has been resolved: mtd: mtdswap: Avoid freeing registered blktrans device twice In mtdswapaddmtd, debugfs setup failure after successful blktrans registration can free mbddev twice. addmtdblktransdev initializes the blktrans device reference and...

EUVD-2026-82157

In the Linux kernel, the following vulnerability has been resolved: drm/v3d: Associate BOs with every job that accesses them A submission can expand into a chain of jobs e.g. bin + render + cache clean. Implicit synchronization in v3dsubmitlockreservations is gated on each job's bo, but the BO li...

EUVD-2026-82156

In the Linux kernel, the following vulnerability has been resolved: software node: Fix softwarenodegetreferenceargs with index -1 The bounds check for the index passed to softwarenodegetreferenceargs was failing when passed UINTMAX, this in turn would lead to an out of bound access in the propert...

EUVD-2026-82154

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow interpreter fallback for arena-related insns Since the interpreter does not support the arena-related insns, interpreter fallback should not be allowed for these insns in core.c::bpfprogselectruntime. Currently, whe...

EUVD-2026-82155

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject arena frees below the arena base bpfarenafreepages accepts scalar arena addresses. The runtime masks the address to the low 32 bits and reconstructs a full user address from the arena base before returning the range t...