EUVD-2026-81810

In the Linux kernel, the following vulnerability has been resolved: bpf: Compare iterator types during state pruning An iterator stack slot can be MEMRCU or PTRUNTRUSTED. These states must not be equal, or the verifier can prune an unsafe path. Compare the pointer type for STACKITER slots...

EUVD-2026-81809

In the Linux kernel, the following vulnerability has been resolved: ubi: Fix rollback for explicit UBI device numbers ubiinitattach rolls back module initialization failures by scanning ubidevices0..i-1, where i is the mtd= parameter index. That assumes the parameter index matches the UBI device...

EUVD-2026-81808

In the Linux kernel, the following vulnerability has been resolved: mtd: ubi: Release device reference on busy detach ubidetachmtddev obtains a device reference through ubigetdevice before checking whether the UBI device is busy. The busy return path drops ubi-refcount but leaves the device...

EUVD-2026-81807

In the Linux kernel, the following vulnerability has been resolved: ASoC: xilinx: formatterpcm: fix streamdata leak on open error In xlnxformatterpcmopen, streamdata is allocated and adata-playstream or adata-capturestream is assigned early. If a later step, such as sndpcmhwconstraintstep or...

EUVD-2026-81806

In the Linux kernel, the following vulnerability has been resolved: firewire: core: fix memory leak in error path of buildtree In the error path of buildtree, node instances can remain in the local linked list when the function returns. Whenever an invalid value is detected in the self ID sequenc...

EUVD-2026-81805

In the Linux kernel, the following vulnerability has been resolved: arm64/efi: Avoid voluntary preemption with efimm installed Gus reports a bad kernel memory access when using software PAN CONFIGARM64SWTTBR0PAN=y on a machine with support for EFI runtime services: Unable to handle kernel access ...

EUVD-2026-81804

In the Linux kernel, the following vulnerability has been resolved: bpf, s390: Clear fetch destination on faulting arena atomic Same missing register clear as on riscv64. A RMW atomic on an arena pointer is converted to BPFPROBEATOMIC and gets an exception table entry, but bpfjitprobeatomicpre on...

EUVD-2026-81802

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix deadlock during unregister Unregistering an s390dbf debug area while one of the associated debugfs files is being written to can cause a deadlock: $ echo .../vmur/level $ rmmod vmur...

EUVD-2026-81803

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF in bpftrampolinemultiattachfree on update failure When bpftrampolineupdate fails before modifyfentrymulti/ unregisterfentrymulti is called, curimage is unchanged curimage == oldimage and ftrace still calls into it...

EUVD-2026-81801

In the Linux kernel, the following vulnerability has been resolved: clocksource/drivers/samsungpwm: Switch to rawspinlockt type Samsung PWM timer might be used as a clock source on some legacy systems. When PREEMPTRT is enabled on ARM, regular spinlock is converted to a sleeping lock mutex-based,...

EUVD-2026-81799

In the Linux kernel, the following vulnerability has been resolved: nvmet: fix maxqid race between configfs and controller allocation The function nvmetsubsysattrqidmaxstore can race against nvmetallocctrl when a subsystem's maxqid limit is modified. Suppose maxqid is currently 64. If...

EUVD-2026-81800

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: midi: Serialize input teardown with eventinput sndmidiinputevent must not be running while a rawmidi substream is closing, since this can lead to the trigger state becoming out-of-step through this sequence in...

EUVD-2026-81798

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan slots during inode read". OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index...

EUVD-2026-81797

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate DIO orphan slot during inode read BUG A corrupted append-DIO dinode high byte at offset 0xa1 corrupted from 0 to 1 can carry an idioorphanedslot outside the mounted filesystem slot range and trigger a use-after-fr...

EUVD-2026-81796

In the Linux kernel, the following vulnerability has been resolved: Squashfs: check block offset is not negative If a negative offset is read off disk for example the offset into the decompressed fragment block, this will cause squashfscopydata to perform an out of bounds access. Fix by checking ...

EUVD-2026-81795

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers basereleasememorypools unconditionally frees every ioc-pciesglookup entry, including ones the setup loop never allocated after a partial failure, causing a "bad dma" warni...

EUVD-2026-81794

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix UAF in pagepoolreleasenetmemdma on xacmpxchg race This bug was discovered while testing the hns3 driver under channel reconfiguration ethtool -L / ethtool -G with iperf3 traffic on arm64. The race is...

EUVD-2026-81793

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: fix integer overflow in MFT cluster validation In ntfsinitfromboot, the boot sector's MFT cluster numbers are validated against the volume size with: if mlcn sctperclst = sectors || mlcn2 sctperclst = sectors goto out;...

EUVD-2026-81792

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: reject out-of-range evcn in mienumattr In mienumattr, the start/end VCN validation for non-resident attributes is: if svcn evcn + 1 goto out; When evcn is U64MAX the "evcn + 1" expression wraps to 0 and any svcn passes...

EUVD-2026-81790

In the Linux kernel, the following vulnerability has been resolved: HID: haptic: don't write an uninitialized value to unhandled usages filleffectbuf initializes value only for the four haptic usages handled by its switch, but writes it to field-value for every usage. An unhandled usage can...

EUVD-2026-81791

In the Linux kernel, the following vulnerability has been resolved: ALSA: core: Fix use-after-free in sndcarddofree A use-after-free was detected in sndcarddofree when a sound card managed by devres is unbound while a user-space application still holds an open file descriptor. For managed cards,...

EUVD-2026-81789

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: validate topology volume range before allocation SOF treats the topology mixer min and max values as non-negative indices into its volume table. It stores them in signed fields, allocates max + 1 entries through an int...

EUVD-2026-81788

In the Linux kernel, the following vulnerability has been resolved: riscv, bpf: Fix missing sign-ext for signed 1-byte and 2-byte kfunc args On RV64, the ABI requires sign-extension for signed 1-byte and 2-byte kfunc args. However, the RV64 JIT currently does not perform sign-extension for such...

EUVD-2026-81787

In the Linux kernel, the following vulnerability has been resolved: ACPI: scan: fix bus ID cleanup on deviceadd failures When deviceadd fails after acpidevicesetname has allocated an instance ID and a new acpidevicebusid has been linked into acpibusidlist, the rollback path only removes wakeuplis...

EUVD-2026-81786

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: fix PREEMPTRT self-deadlock in IRQ handler qcomcpucpmboxirqfn calls mboxchanreceiveddata while holding chan-lock. Under PREEMPTRT, spinlockirqsave is converted to an rtspinlock rtmutex-based, which tracks...

EUVD-2026-81785

In the Linux kernel, the following vulnerability has been resolved: mailbox: qcom-cpucp: handle NULL data in senddata callback mailboxclearchannel calls mboxsendmessage with NULL data to notify the remote side that the RX channel has been cleared. qcomcpucpmboxsenddata blindly dereferenced the da...

EUVD-2026-81784

In the Linux kernel, the following vulnerability has been resolved: mailbox: riscv-sbi-mpxy: validate RPMI notification lengths The SBI return value controls how many bytes are copied from shared memory into the RPMI notification buffer. It is not validated against the negotiated shared-memory si...

EUVD-2026-81783

In the Linux kernel, the following vulnerability has been resolved: nullblk: use DEFINEMUTEX for the file-scope mutex In nullinit, mutexinit&lock currently happens after configfsregistersubsystem, which exposes the nullb subsystem to userspace. A racing mkdir into /sys/kernel/config/nullb/ can...

EUVD-2026-81782

In the Linux kernel, the following vulnerability has been resolved: nullblk: register configfs subsystem after creating default devices In nullinit, configfsregistersubsystem currently runs before registerblkdev, so when nullblk is built as a module, a racing mkdir + poweron from userspace can...

EUVD-2026-81781

In the Linux kernel, the following vulnerability has been resolved: nullblk: free global tagset on init error path If sharedtags is enabled, nullsetuptagset allocates the global tagset via nullinitglobaltagset. If device creation later fails, errdev destroys the default devices and calls...

EUVD-2026-81780

In the Linux kernel, the following vulnerability has been resolved: nullblk: free zones array on device power-off nullinitzoneddev allocates dev-zones when a zoned device is powered on, but nulldeldev never frees it on power-off; dev-zones is only freed later in nullfreedev, when the configfs...

EUVD-2026-81779

In the Linux kernel, the following vulnerability has been resolved: nullblk: reject per-device queue resize for shared tag set When sharedtags is enabled, nullsetuptagset makes the device use the global tagset, whose driverdata stays NULL. nullmapqueues therefore falls back to the module-wide...

EUVD-2026-81778

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute stores with the lock The NULLBDEVICEATTR store takes no lock: applyfn attributes submitqueues, pollqueues get dev-NAME written again after applyfn returns, outside its lock; APPLY=NULL...

EUVD-2026-81776

In the Linux kernel, the following vulnerability has been resolved: blk-iolatency: clear delay state when freeing policy data io.latency can throttle a group which has no latency target of its own. When a sibling misses its target, checkscalechange scales down its peers, and a peer that reaches...

EUVD-2026-81777

In the Linux kernel, the following vulnerability has been resolved: nullblk: serialize configfs attribute updates with device setup The attribute store methods generated with NULLBDEVICEATTR refuse to change the configuration of a live device by testing NULLBDEVFLCONFIGURED, but that flag is only...

EUVD-2026-81775

In the Linux kernel, the following vulnerability has been resolved: blk-iocost: clear delay state when freeing policy data iocgkickdelay turns sufficiently large debt into an explicit block-cgroup delay with blkcgsetdelay, setting blkg-usedelay to -1 and incrementing blkcg-congestioncount. Cleari...

EUVD-2026-81774

In the Linux kernel, the following vulnerability has been resolved: ublk: avoid teardown retry loop on xarray allocation failure ublkshmemremoveranges removes matching maple tree ranges in batches, but first stores each range into a temporary xarray so that the pages can be unpinned after droppin...

EUVD-2026-81773

In the Linux kernel, the following vulnerability has been resolved: block: mtip32xx: synchronize ioctls with device removal The ioctl handlers only test REMOVEPENDING before entering mtiphwioctl. Removal can set that bit immediately afterwards and free dd-port in mtiphwexit while an ioctl still...

EUVD-2026-81772

In the Linux kernel, the following vulnerability has been resolved: apparmor: fix deadlock in complain-mode changehat The use of changehat when in complain mode can cause a deadlock when the hat doesn't exist and a new learning profile is created for the missing profile. This is because changehat...

EUVD-2026-81770

In the Linux kernel, the following vulnerability has been resolved: bpf: Check pointer type for all atomic RMW paths Atomic RMW verification records an instruction pointer type only when the current destination is PTRTOARENA. A second path can therefore reach the same instruction with an ordinary...

EUVD-2026-81771

In the Linux kernel, the following vulnerability has been resolved: hwmon: coretemp Fix coredata leak on CPUs without PTS pdata-coredata is allocated in inittempdata when the first core tempdata of a package is created, but it is only released from destroytempdata, and only in the branch that...

EUVD-2026-81769

In the Linux kernel, the following vulnerability has been resolved: ksmbd: Do not skip lock checks for single-byte ranges checklockrange uses inclusive ranges. Its callers pass the end offset as start + length - 1, so start == end represents a valid single-byte range rather than an empty range. T...

EUVD-2026-81768

In the Linux kernel, the following vulnerability has been resolved: smb: server: fix leak of ksmbdipcloginrequestext returned buffer Free it unconditionally after ksmbdallocuser calls. kmemleak splat: unreferenced object 0xffff888103b83540 size 192: comm "pool-0", pid 16970, jiffies 4377290937 he...

EUVD-2026-81767

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix slab-out-of-bounds read in ksmbdallocuser ksmbdallocuser copies resp-hashsz bytes out of the mountd IPC login response with user-passkeysz = resp-hashsz; user-passkey = kmallocresp-hashsz, KSMBDDEFAULTGFP; if...

EUVD-2026-81766

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: free completion queues with ibfreecq smbdirectconnectiondestroyqp creates the send and receive completion queues with iballoccqany, which for IBPOLLWORKQUEUE arms an internal completion handler that runs...

EUVD-2026-81765

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: destroy QP before mem pools on accept failure On the rdmaacceptfailed error path of smbdirectacceptconnectrequest, the receive io posted just above is owned by the QP recvio is set to NULL after a successful post...

EUVD-2026-81764

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirectsocketdestroy releases the listener's pending/ready child sockets while still holding the listener's handler lock, the &idpriv-handlermutex taken via...

EUVD-2026-81763

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ipc response length before dereferencing its fields ipcvalidatemsg computes the expected message size by reading length fields out of the response buffer supplied by the userspace ksmbd daemon payloadsz,...

EUVD-2026-81761

In the Linux kernel, the following vulnerability has been resolved: ksmbd: retain connection for pending notify work Deferred CHANGENOTIFY work keeps an async message ID after the original request work is released. A durable handle can outlive its connection, so the connection teardown can destro...

EUVD-2026-81762

In the Linux kernel, the following vulnerability has been resolved: ksmbd: free preauth sessions on connection teardown SMB3.1.1 multichannel binding preserves the preauthentication hash in a preauthsession between the NTLM negotiate and authenticate requests. The binding NTLM negotiate allocates...