EUVD-2026-108907

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935

The Linux kernel is affected by an information leak vulnerability within the RTC (Real Time Clock) subsystem. Specifically, the struct rtc_wkalrm contains padding holes following the 'pending' member. When this structure is returned to userspace via the RTC_WKALRM_RD ioctl , uninitialized kernel ...

CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98934 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

EUVD-2026-108906

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-98934

The Linux kernel contains a vulnerability where the seg6_make_flowlabel() function could be reached with a socket buffer (skb ) lacking both skb->dev and skb->sk pointers. This issue occurs when a TIPC UDP bearer sends a discovery message via an IPv4 route using seg6 encap while net.ipv6.se...

CVE-2026-98934 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-98933 usb: hub: use shorter 120ms post resume hold for SS root hubs

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

EUVD-2026-108905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-98933

The Linux kernel contains a vulnerability where holding a USB3 hub PM runtime reference for 200ms during hub resume triggers issues on AMD platforms . This specifically causes crashes for users running Android adb after the subsystem has been polled and woken periodically. The root cause is ident...

CVE-2026-98933 usb: hub: use shorter 120ms post resume hold for SS root hubs

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

EUVD-2026-108904

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98932

The Linux kernel contains a use-after-free vulnerability within the EDAC/altera component. Specifically, in both altr_edac_a10_device_add() and altr_portb_setup(), the error path incorrectly freed the dci structure before releasing the devres group . Because managed single and double bit IRQ hand...

CVE-2026-98931 mtd: spinand: fix NULL pointer dereference with no ECC engine

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

EUVD-2026-108903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98931 mtd: spinand: fix NULL pointer dereference with no ECC engine

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98931

The Linux kernel contains a vulnerability in the mtd: spinand component where a NULL pointer dereference occurs when the "nand-no-ecc-engine" property is set in the Device Tree. Specifically, nanddev_get_ecc_engine() returns success while leaving nand->ecc.engine as NULL, but the SPI-NAND code...