CVE-2026-98821 block: reject polled dio with user integrity metadata

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98821

The Linux kernel contains a vulnerability where IOPOLL calls bio_poll() on uio_meta instead of a bio structure when user integrity metadata is present. This occurs because IOCB_HAS_METADATA leaves iocb->private as uio_meta, but iocb_bio_iopoll() expects a bio, and since commit 2729a60bbfb9, me...

EUVD-2026-103906

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98821 block: reject polled dio with user integrity metadata

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

EUVD-2026-103905

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

CVE-2026-98820

The Linux kernel contains a vulnerability in blk-mq where cached requests, initially allocated for one operation, could be reused for another. Specifically, if a passthrough command has RQF_USE_SCHED cleared, subsequent read/write bios might use these flags incorrectly. This results in requests b...

CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

EUVD-2026-103904

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819

The Linux kernel contains a vulnerability in the btintel Bluetooth driver regarding how it handles DDC record lengths . The root cause is that record lengths were parsed in a manner where the value 0xFF could wrap, potentially leading to incorrect processing. The fix involves parsing lengths in u...

CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

CVE-2026-98818

The Linux kernel contains a deadlock vulnerability in the mm/slab component. The issue arises because kfree_rcu() can be called while holding the pi_lock (a raw spinlock in the scheduler). If kfree_rcu() attempts to allocate memory using __GFP_KSWAPD_RECLAIM , it can wake up kswapd , which then t...

CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

EUVD-2026-103903

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

EUVD-2026-103902

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

CVE-2026-98817

The Linux kernel addressed an issue within the ASoC: SDCA component related to pm_runtime error handling. The vulnerability involved a missing common error path during the func probe process, which prevented the proper balancing of the runtime PM reference . The fix ensures that the reference is ...

CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...