EUVD-2026-103777

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...

CVE-2026-98837 ALSA: caiaq: unregister the input device when probe fails

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...

CVE-2026-98836 ALSA: line6: reject oversized playback packets

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

CVE-2026-98836 ALSA: line6: reject oversized playback packets

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

EUVD-2026-103776

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

CVE-2026-98836

A slab-out-of-bounds vulnerability exists in the Linux kernel ALSA line6 driver. The issue occurs in submit_audio_out_urb() because the number of bytes written into an out.buffer slice is not validated against the slice size. On devices with a large IN wMaxPacketSize and a small OUT wMaxPacketSiz...

CVE-2026-98835 iio: accel: kionix-kx022a: Fix array boundary check

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

CVE-2026-98835 iio: accel: kionix-kx022a: Fix array boundary check

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

EUVD-2026-103775

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

CVE-2026-98835

The Linux kernel contains a vulnerability in the iio: accel: kionix-kx022a driver. The driver fails to perform an accurate sanity check when converting a register value to an array index, incorrectly accepting sizeof(array) as a valid index instead of sizeof(array) - 1 . This constitutes an array...

CVE-2026-98834 mtd: core: avoid double-free of OTP NVMEM device

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

CVE-2026-98834 mtd: core: avoid double-free of OTP NVMEM device

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

EUVD-2026-103774

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

CVE-2026-98834

A vulnerability exists in the Linux kernel 's mtd core component related to the OTP NVMEM device . The issue is caused by a logic error where mtd_otp_nvmem_add() unregisters a user device during a factory OTP setup failure but fails to clear the mtd->otp_user_nvmem pointer. This leads to a dou...

CVE-2026-98833 mtd: core: call _get_device() with the master MTD

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

EUVD-2026-103773

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

CVE-2026-98833 mtd: core: call _get_device() with the master MTD

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

CVE-2026-98833

The Linux kernel contains a vulnerability in the mtd core where __get_mtd_device() incorrectly calls the master's _get_device() callback using the mtd (which may be a partition) instead of the master itself. This inconsistency breaks gluebi partitions because gluebi_get_device() requires the mast...

EUVD-2026-103772

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...