xamxte/cve-to-cwe huggingface dataset:
CVE-2026-23121: In the Linux kernel, the following vulnerability has been resolved:  mISDN: annotate data-race around dev->work  dev->work can re read locklessly in mISDN_read() and mISDN_poll(). Add READ_ONCE()/WRITE_ONCE() annotations.  BUG: KCSAN: data-race in mISDN_ioctl / mISDN_read  write to 0xffff88812d848280 of 4 bytes by task 10864 on cpu 1:   misdn_add_timer drivers/isdn/mISDN/timerdev.c:175 [inline]   mISDN_ioctl+0x2fb/0x550 drivers/isdn/mISDN/timerdev.c:233   vfs_ioctl fs/ioctl.c:51 [inline]   __do_sys_ioctl fs/ioctl.c:597 [inline]   __se_sys_ioctl+0xce/0x140 fs/ioctl.c:583   __x64_sys_ioctl+0x43/0x50 fs/ioctl.c:583   x64_sys_call+0x14b0/0x3000 arch/x86/include/generated/asm/syscalls_64.h:17   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]   do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x77/0x7f  read to 0xffff88812d848280 of 4 bytes by task 10857 on cpu 0:   mISDN_read+0x1f2/0x470 drivers/isdn/mISDN/timerdev.c:112   do_loop_readv_writev fs/read_write.c:847 [inline]   vfs_readv+0x3fb/0x690 fs/read_write.c:1020   do_readv+0xe7/0x210 fs/read_write.c:1080   __do_sys_readv fs/read_write.c:1165 [inline]   __se_sys_readv fs/read_write.c:1162 [inline]   __x64_sys_readv+0x45/0x50 fs/read_write.c:1162   x64_sys_call+0x2831/0x3000 arch/x86/include/generated/asm/syscalls_64.h:20   do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]   do_syscall_64+0xd8/0x2c0 arch/x86/entry/syscall_64.c:94  entry_SYSCALL_64_after_hwframe+0x77/0x7f  value changed: 0x00000000 -> 0x00000001
CVE-2026-23123: In the Linux kernel, the following vulnerability has been resolved:  interconnect: debugfs: initialize src_node and dst_node to empty strings  The debugfs_create_str() API assumes that the string pointer is either NULL or points to valid kmalloc() memory. Leaving the pointer uninitialized can cause problems.  Initialize src_node and dst_node to empty strings before creating the debugfs entries to guarantee that reads and writes are safe.
CVE-2026-23124: In the Linux kernel, the following vulnerability has been resolved:  ipv6: annotate data-race in ndisc_router_discovery()  syzbot found that ndisc_router_discovery() could read and write in6_dev->ra_mtu without holding a lock [1]  This looks fine, IFLA_INET6_RA_MTU is best effort.  Add READ_ONCE()/WRITE_ONCE() to document the race.  Note that we might also reject illegal MTU values (mtu < IPV6_MIN_MTU || mtu > skb->dev->mtu) in a future patch.  [1] BUG: KCSAN: data-race in ndisc_router_discovery / ndisc_router_discovery  read to 0xffff888119809c20 of 4 bytes by task 25817 on cpu 1:   ndisc_router_discovery+0x151d/0x1c90 net/ipv6/ndisc.c:1558   ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841   icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989   ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438   ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489   NF_HOOK include/linux/netfilter.h:318 [inline]   ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500   ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590   dst_input include/net/dst.h:474 [inline]   ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ...  write to 0xffff888119809c20 of 4 bytes by task 25816 on cpu 0:   ndisc_router_discovery+0x155a/0x1c90 net/ipv6/ndisc.c:1559   ndisc_rcv+0x2ad/0x3d0 net/ipv6/ndisc.c:1841   icmpv6_rcv+0xe5a/0x12f0 net/ipv6/icmp.c:989   ip6_protocol_deliver_rcu+0xb2a/0x10d0 net/ipv6/ip6_input.c:438   ip6_input_finish+0xf0/0x1d0 net/ipv6/ip6_input.c:489   NF_HOOK include/linux/netfilter.h:318 [inline]   ip6_input+0x5e/0x140 net/ipv6/ip6_input.c:500   ip6_mc_input+0x27c/0x470 net/ipv6/ip6_input.c:590   dst_input include/net/dst.h:474 [inline]   ip6_rcv_finish+0x336/0x340 net/ipv6/ip6_input.c:79 ...  value changed: 0x00000000 -> 0xe5400659
CVE-2026-23125: In the Linux kernel, the following vulnerability has been resolved:  sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT  A null-ptr-deref was reported in the SCTP transmit path when SCTP-AUTH key initialization fails:    ==================================================================   KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]   CPU: 0 PID: 16 Comm: ksoftirqd/0 Tainted: G W 6.6.0 #2   RIP: 0010:sctp_packet_bundle_auth net/sctp/output.c:264 [inline]   RIP: 0010:sctp_packet_append_chunk+0xb36/0x1260 net/sctp/output.c:401   Call Trace:    sctp_packet_transmit_chunk+0x31/0x250 net/sctp/output.c:189   sctp_outq_flush_data+0xa29/0x26d0 net/sctp/outqueue.c:1111   sctp_outq_flush+0xc80/0x1240 net/sctp/outqueue.c:1217   sctp_cmd_interpreter.isra.0+0x19a5/0x62c0 net/sctp/sm_sideeffect.c:1787   sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]   sctp_do_sm+0x1a3/0x670 net/sctp/sm_sideeffect.c:1169   sctp_assoc_bh_rcv+0x33e/0x640 net/sctp/associola.c:1052   sctp_inq_push+0x1dd/0x280 net/sctp/inqueue.c:88   sctp_rcv+0x11ae/0x3100 net/sctp/input.c:243   sctp6_rcv+0x3d/0x60 net/sctp/ipv6.c:1127  The issue is triggered when sctp_auth_asoc_init_active_key() fails in sctp_sf_do_5_1C_ack() while processing an INIT_ACK. In this case, the command sequence is currently:  - SCTP_CMD_PEER_INIT - SCTP_CMD_TIMER_STOP (T1_INIT) - SCTP_CMD_TIMER_START (T1_COOKIE) - SCTP_CMD_NEW_STATE (COOKIE_ECHOED) - SCTP_CMD_ASSOC_SHKEY - SCTP_CMD_GEN_COOKIE_ECHO  If SCTP_CMD_ASSOC_SHKEY fails, asoc->shkey remains NULL, while asoc->peer.auth_capable and asoc->peer.peer_chunks have already been set by SCTP_CMD_PEER_INIT. This allows a DATA chunk with auth = 1 and shkey = NULL to be queued by sctp_datamsg_from_user().  Since command interpretation stops on failure, no COOKIE_ECHO should been sent via SCTP_CMD_GEN_COOKIE_ECHO. However, the T1_COOKIE timer has already been started, and it may enqueue a COOKIE_ECHO into the outqueue later. As a result, the DATA chunk can be transmitted together with the COOKIE_ECHO in sctp_outq_flush_data(), leading to the observed issue.  Similar to the other places where it calls sctp_auth_asoc_init_active_key() right after sctp_process_init(), this patch moves the SCTP_CMD_ASSOC_SHKEY immediately after SCTP_CMD_PEER_INIT, before stopping T1_INIT and starting T1_COOKIE. This ensures that if shared key generation fails, authenticated DATA cannot be sent. It also allows the T1_INIT timer to retransmit INIT, giving the client another chance to process INIT_ACK and retry key setup.
CVE-2026-23126: In the Linux kernel, the following vulnerability has been resolved:  netdevsim: fix a race issue related to the operation on bpf_bound_progs list  The netdevsim driver lacks a protection mechanism for operations on the bpf_bound_progs list. When the nsim_bpf_create_prog() performs list_add_tail, it is possible that nsim_bpf_destroy_prog() is simultaneously performs list_del. Concurrent operations on the list may lead to list corruption and trigger a kernel crash as follows:  [  417.290971] kernel BUG at lib/list_debug.c:62! [  417.290983] invalid opcode: 0000 [#1] PREEMPT SMP NOPTI [  417.290992] CPU: 10 PID: 168 Comm: kworker/10:1 Kdump: loaded Not tainted 6.19.0-rc5 #1 [  417.291003] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [  417.291007] Workqueue: events bpf_prog_free_deferred [  417.291021] RIP: 0010:__list_del_entry_valid_or_report+0xa7/0xc0 [  417.291034] Code: a8 ff 0f 0b 48 89 fe 48 89 ca 48 c7 c7 48 a1 eb ae e8 ed fb a8 ff 0f 0b 48 89 fe 48 89 c2 48 c7 c7 80 a1 eb ae e8 d9 fb a8 ff <0f> 0b 48 89 d1 48 c7 c7 d0 a1 eb ae 48 89 f2 48 89 c6 e8 c2 fb a8 [  417.291040] RSP: 0018:ffffb16a40807df8 EFLAGS: 00010246 [  417.291046] RAX: 000000000000006d RBX: ffff8e589866f500 RCX: 0000000000000000 [  417.291051] RDX: 0000000000000000 RSI: ffff8e59f7b23180 RDI: ffff8e59f7b23180 [  417.291055] RBP: ffffb16a412c9000 R08: 0000000000000000 R09: 0000000000000003 [  417.291059] R10: ffffb16a40807c80 R11: ffffffffaf9edce8 R12: ffff8e594427ac20 [  417.291063] R13: ffff8e59f7b44780 R14: ffff8e58800b7a05 R15: 0000000000000000 [  417.291074] FS:  0000000000000000(0000) GS:ffff8e59f7b00000(0000) knlGS:0000000000000000 [  417.291079] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [  417.291083] CR2: 00007fc4083efe08 CR3: 00000001c3626006 CR4: 0000000000770ee0 [  417.291088] PKRU: 55555554 [  417.291091] Call Trace: [  417.291096]  <TASK> [  417.291103]  nsim_bpf_destroy_prog+0x31/0x80 [netdevsim] [  417.291154]  __bpf_prog_offload_destroy+0x2a/0x80 [  417.291163]  bpf_prog_dev_bound_destroy+0x6f/0xb0 [  417.291171]  bpf_prog_free_deferred+0x18e/0x1a0 [  417.291178]  process_one_work+0x18a/0x3a0 [  417.291188]  worker_thread+0x27b/0x3a0 [  417.291197]  ? __pfx_worker_thread+0x10/0x10 [  417.291207]  kthread+0xe5/0x120 [  417.291214]  ? __pfx_kthread+0x10/0x10 [  417.291221]  ret_from_fork+0x31/0x50 [  417.291230]  ? __pfx_kthread+0x10/0x10 [  417.291236]  ret_from_fork_asm+0x1a/0x30 [  417.291246]  </TASK>  Add a mutex lock, to prevent simultaneous addition and deletion operations on the list.
CVE-2026-23130: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix dead lock while flushing management frames  Commit [1] converted the management transmission work item into a wiphy work. Since a wiphy work can only run under wiphy lock protection, a race condition happens in below scenario:  1. a management frame is queued for transmission. 2. ath12k_mac_op_flush() gets called to flush pending frames associated    with the hardware (i.e, vif being NULL). Then in ath12k_mac_flush()    the process waits for the transmission done. 3. Since wiphy lock has been taken by the flush process, the transmission    work item has no chance to run, hence the dead lock.  >From user view, this dead lock results in below issue:   wlp8s0: authenticate with xxxxxx (local address=xxxxxx)  wlp8s0: send auth to xxxxxx (try 1/3)  wlp8s0: authenticate with xxxxxx (local address=xxxxxx)  wlp8s0: send auth to xxxxxx (try 1/3)  wlp8s0: authenticated  wlp8s0: associate with xxxxxx (try 1/3)  wlp8s0: aborting association with xxxxxx by local choice (Reason: 3=DEAUTH_LEAVING)  ath12k_pci 0000:08:00.0: failed to flush mgmt transmit queue, mgmt pkts pending 1  The dead lock can be avoided by invoking wiphy_work_flush() to proactively run the queued work item. Note actually it is already present in ath12k_mac_op_flush(), however it does not protect the case where vif being NULL. Hence move it ahead to cover this case as well.  Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3
CVE-2026-23131: In the Linux kernel, the following vulnerability has been resolved:  platform/x86: hp-bioscfg: Fix kobject warnings for empty attribute names  The hp-bioscfg driver attempts to register kobjects with empty names when the HP BIOS returns attributes with empty name strings. This causes multiple kernel warnings:    kobject: (00000000135fb5e6): attempted to be registered with empty name!   WARNING: CPU: 14 PID: 3336 at lib/kobject.c:219 kobject_add_internal+0x2eb/0x310  Add validation in hp_init_bios_buffer_attribute() to check if the attribute name is empty after parsing it from the WMI buffer. If empty, log a debug message and skip registration of that attribute, allowing the module to continue processing other valid attributes.
CVE-2026-23132: In the Linux kernel, the following vulnerability has been resolved:  drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind  Fix several issues in dw_dp_bind() error handling:  1. Missing return after drm_bridge_attach() failure - the function    continued execution instead of returning an error.  2. Resource leak: drm_dp_aux_register() is not a devm function, so    drm_dp_aux_unregister() must be called on all error paths after    aux registration succeeds. This affects errors from:    - drm_bridge_attach()    - phy_init()    - devm_add_action_or_reset()    - platform_get_irq()    - devm_request_threaded_irq()  3. Bug fix: platform_get_irq() returns the IRQ number or a negative    error code, but the error path was returning ERR_PTR(ret) instead    of ERR_PTR(dp->irq).  Use a goto label for cleanup to ensure consistent error handling.
CVE-2026-23135: In the Linux kernel, the following vulnerability has been resolved:  wifi: ath12k: fix dma_free_coherent() pointer  dma_alloc_coherent() allocates a DMA mapped buffer and stores the addresses in XXX_unaligned fields.  Those should be reused when freeing the buffer rather than the aligned addresses.
CVE-2026-23136: In the Linux kernel, the following vulnerability has been resolved:  libceph: reset sparse-read state in osd_fault()  When a fault occurs, the connection is abandoned, reestablished, and any pending operations are retried. The OSD client tracks the progress of a sparse-read reply using a separate state machine, largely independent of the messenger's state.  If a connection is lost mid-payload or the sparse-read state machine returns an error, the sparse-read state is not reset. The OSD client will then interpret the beginning of a new reply as the continuation of the old one. If this makes the sparse-read machinery enter a failure state, it may never recover, producing loops like:    libceph:  [0] got 0 extents   libceph: data len 142248331 != extent len 0   libceph: osd0 (1)...:6801 socket error on read   libceph: data len 142248331 != extent len 0   libceph: osd0 (1)...:6801 socket error on read  Therefore, reset the sparse-read state in osd_fault(), ensuring retries start from a clean state.
CVE-2026-23137: In the Linux kernel, the following vulnerability has been resolved:  of: unittest: Fix memory leak in unittest_data_add()  In unittest_data_add(), if of_resolve_phandles() fails, the allocated unittest_data is not freed, leading to a memory leak.  Fix this by using scope-based cleanup helper __free(kfree) for automatic resource cleanup. This ensures unittest_data is automatically freed when it goes out of scope in error paths.  For the success path, use retain_and_null_ptr() to transfer ownership of the memory to the device tree and prevent double freeing.
CVE-2026-23139: In the Linux kernel, the following vulnerability has been resolved:  netfilter: nf_conncount: update last_gc only when GC has been performed  Currently last_gc is being updated everytime a new connection is tracked, that means that it is updated even if a GC wasn't performed. With a sufficiently high packet rate, it is possible to always bypass the GC, causing the list to grow infinitely.  Update the last_gc value only when a GC has been actually performed.
CVE-2026-23141: In the Linux kernel, the following vulnerability has been resolved:  btrfs: send: check for inline extents in range_is_hole_in_parent()  Before accessing the disk_bytenr field of a file extent item we need to check if we are dealing with an inline extent. This is because for inline extents their data starts at the offset of the disk_bytenr field. So accessing the disk_bytenr means we are accessing inline data or in case the inline data is less than 8 bytes we can actually cause an invalid memory access if this inline extent item is the first item in the leaf or access metadata from other items.
CVE-2026-23142: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure  When a DAMOS-scheme DAMON sysfs directory setup fails after setup of access_pattern/ directory, subdirectories of access_pattern/ directory are not cleaned up.  As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked.  Cleanup the directories under such failures.
CVE-2026-23144: In the Linux kernel, the following vulnerability has been resolved:  mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure  When a context DAMON sysfs directory setup is failed after setup of attrs/ directory, subdirectories of attrs/ directory are not cleaned up.  As a result, DAMON sysfs interface is nearly broken until the system reboots, and the memory for the unremoved directory is leaked.  Cleanup the directories under such failures.
CVE-2026-23145: In the Linux kernel, the following vulnerability has been resolved:  ext4: fix iloc.bh leak in ext4_xattr_inode_update_ref  The error branch for ext4_xattr_inode_update_ref forget to release the refcount for iloc.bh. Find this when review code.
CVE-2026-23146: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work  hci_uart_set_proto() sets HCI_UART_PROTO_INIT before calling hci_uart_register_dev(), which calls proto->open() to initialize hu->priv. However, if a TTY write wakeup occurs during this window, hci_uart_tx_wakeup() may schedule write_work before hu->priv is initialized, leading to a NULL pointer dereference in hci_uart_write_work() when proto->dequeue() accesses hu->priv.  The race condition is:    CPU0                              CPU1   ----                              ----   hci_uart_set_proto()     set_bit(HCI_UART_PROTO_INIT)     hci_uart_register_dev()                                     tty write wakeup                                       hci_uart_tty_wakeup()                                         hci_uart_tx_wakeup()                                           schedule_work(&hu->write_work)       proto->open(hu)         // initializes hu->priv                                     hci_uart_write_work()                                       hci_uart_dequeue()                                         proto->dequeue(hu)                                           // accesses hu->priv (NULL!)  Fix this by moving set_bit(HCI_UART_PROTO_INIT) after proto->open() succeeds, ensuring hu->priv is initialized before any work can be scheduled.
CVE-2026-23147: In the Linux kernel, the following vulnerability has been resolved:  btrfs: zlib: fix the folio leak on S390 hardware acceleration  [BUG] After commit aa60fe12b4f4 ("btrfs: zlib: refactor S390x HW acceleration buffer preparation"), we no longer release the folio of the page cache of folio returned by btrfs_compress_filemap_get_folio() for S390 hardware acceleration path.  [CAUSE] Before that commit, we call kumap_local() and folio_put() after handling each folio.  Although the timing is not ideal (it release previous folio at the beginning of the loop, and rely on some extra cleanup out of the loop), it at least handles the folio release correctly.  Meanwhile the refactored code is easier to read, it lacks the call to release the filemap folio.  [FIX] Add the missing folio_put() for copy_data_into_buffer().
CVE-2026-23148: In the Linux kernel, the following vulnerability has been resolved:  nvmet: fix race in nvmet_bio_done() leading to NULL pointer dereference  There is a race condition in nvmet_bio_done() that can cause a NULL pointer dereference in blk_cgroup_bio_start():  1. nvmet_bio_done() is called when a bio completes 2. nvmet_req_complete() is called, which invokes req->ops->queue_response(req) 3. The queue_response callback can re-queue and re-submit the same request 4. The re-submission reuses the same inline_bio from nvmet_req 5. Meanwhile, nvmet_req_bio_put() (called after nvmet_req_complete)    invokes bio_uninit() for inline_bio, which sets bio->bi_blkg to NULL 6. The re-submitted bio enters submit_bio_noacct_nocheck() 7. blk_cgroup_bio_start() dereferences bio->bi_blkg, causing a crash:    BUG: kernel NULL pointer dereference, address: 0000000000000028   #PF: supervisor read access in kernel mode   RIP: 0010:blk_cgroup_bio_start+0x10/0xd0   Call Trace:    submit_bio_noacct_nocheck+0x44/0x250    nvmet_bdev_execute_rw+0x254/0x370 [nvmet]    process_one_work+0x193/0x3c0    worker_thread+0x281/0x3a0  Fix this by reordering nvmet_bio_done() to call nvmet_req_bio_put() BEFORE nvmet_req_complete(). This ensures the bio is cleaned up before the request can be re-submitted, preventing the race condition.
CVE-2026-23149: In the Linux kernel, the following vulnerability has been resolved:  drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl()  Since GEM bo handles are u32 in the uapi and the internal implementation uses idr_alloc() which uses int ranges, passing a new handle larger than INT_MAX trivially triggers a kernel warning:  idr_alloc(): ...  if (WARN_ON_ONCE(start < 0))   return -EINVAL; ...  Fix it by rejecting new handles above INT_MAX and at the same time make the end limit calculation more obvious by moving into int domain.
CVE-2026-23151: In the Linux kernel, the following vulnerability has been resolved:  Bluetooth: MGMT: Fix memory leak in set_ssp_complete  Fix memory leak in set_ssp_complete() where mgmt_pending_cmd structures are not freed after being removed from the pending list.  Commit 302a1f674c00 ("Bluetooth: MGMT: Fix possible UAFs") replaced mgmt_pending_foreach() calls with individual command handling but missed adding mgmt_pending_free() calls in both error and success paths of set_ssp_complete(). Other completion functions like set_le_complete() were fixed correctly in the same commit.  This causes a memory leak of the mgmt_pending_cmd structure and its associated parameter data for each SSP command that completes.  Add the missing mgmt_pending_free(cmd) calls in both code paths to fix the memory leak. Also fix the same issue in set_advertising_complete().
CVE-2026-23152: In the Linux kernel, the following vulnerability has been resolved:  wifi: mac80211: correctly decode TTLM with default link map  TID-To-Link Mapping (TTLM) elements do not contain any link mapping presence indicator if a default mapping is used and parsing needs to be skipped.  Note that access points should not explicitly report an advertised TTLM with a default mapping as that is the implied mapping if the element is not included, this is even the case when switching back to the default mapping. However, mac80211 would incorrectly parse the frame and would also read one byte beyond the end of the element.
CVE-2026-23153: In the Linux kernel, the following vulnerability has been resolved:  firewire: core: fix race condition against transaction list  The list of transaction is enumerated without acquiring card lock when processing AR response event. This causes a race condition bug when processing AT request completion event concurrently.  This commit fixes the bug by put timer start for split transaction expiration into the scope of lock. The value of jiffies in card structure is referred before acquiring the lock.
CVE-2026-23155: In the Linux kernel, the following vulnerability has been resolved:  can: gs_usb: gs_usb_receive_bulk_callback(): fix error message  Sinc commit 79a6d1bfe114 ("can: gs_usb: gs_usb_receive_bulk_callback(): unanchor URL on usb_submit_urb() error") a failing resubmit URB will print an info message.  In the case of a short read where netdev has not yet been assigned, initialize as NULL to avoid dereferencing an undefined value. Also report the error value of the failed resubmit.
CVE-2026-23156: In the Linux kernel, the following vulnerability has been resolved:  efivarfs: fix error propagation in efivar_entry_get()  efivar_entry_get() always returns success even if the underlying __efivar_entry_get() fails, masking errors.  This may result in uninitialized heap memory being copied to userspace in the efivarfs_file_read() path.  Fix it by returning the error from __efivar_entry_get().
CVE-2026-23158: In the Linux kernel, the following vulnerability has been resolved:  gpio: virtuser: fix UAF in configfs release path  The gpio-virtuser configfs release path uses guard(mutex) to protect the device structure. However, the device is freed before the guard cleanup runs, causing mutex_unlock() to operate on freed memory.  Specifically, gpio_virtuser_device_config_group_release() destroys the mutex and frees the device while still inside the guard(mutex) scope. When the function returns, the guard cleanup invokes mutex_unlock(&dev->lock), resulting in a slab use-after-free.  Limit the mutex lifetime by using a scoped_guard() only around the activation check, so that the lock is released before mutex_destroy() and kfree() are called.