EUVD-2026-108898

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUESTHASSVE from the SVE feature bit at EL2 pkvminitfeaturesfromhost takes KVMARCHFLAGGUESTHASSVE and KVMARMVCPUSVE from the host separately, but pkvmvcpuinitsve tests the bit while vcpuhassve reads the flag. A...

CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98927

The Linux kernel contains a vulnerability in KVM on arm64 architectures regarding the life cycle of the nested_mmus array. The issue stems from these structures being allocated during VCPU_INIT, which could trigger a relocation of the array as it grows. If a relocation occurs while a vcpu is acti...

CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

EUVD-2026-108893

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98926

The Linux kernel contains a vulnerability within the drm/amd/display component related to improper null pointer dereferences. The issue arises because stream->sink is optional and can be null, yet it is accessed without sufficient validation during DPMS (Display Power Management Signaling) seq...

EUVD-2026-108892

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

EUVD-2026-108891

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98925

The Linux kernel contains a vulnerability in bpf, sockmap where a BPF stream_verdict program performing a self-redirect (with BPF_F_INGRESS ) causes double-counting of tcp_sk->copied_seq. When sk_psock_verdict_apply() calls tcp_eat_skb(), it advances the sequence counter; however, the same pac...

CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98924 fs: avoid repeated scans in evict_inodes()

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

EUVD-2026-108888

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98924

A vulnerability in the Linux kernel causes hung tasks when users attempt to unmount a filesystem after its disk has been removed while still in use. The issue occurs because fs_bdev_mark_dead() calls evict_inodes() while holding s_umount . Specifically, whenever evict_inodes() drops s_inode_list_...

CVE-2026-98924 fs: avoid repeated scans in evict_inodes()

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

EUVD-2026-108887

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98923 arm64: io: Reject non-user protection in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98923

The Linux kernel (arm64 architecture) contains a vulnerability where mapping a stack-top page via /dev/mem with PROT_NONE and subsequently reading /proc//cmdline triggers a spurious WARN in ioremap_prot(). This occurs because generic_access_phys() passes protection from a present-invalid PTE to i...