CVE-2026-98888

The Linux kernel (arm64 architecture) contains a flaw where kprobes are incorrectly treated as unrecoverable when hit while in a KPROBE_HIT_SS state. This occurs when tracing or perf code runs from the debug exception path during out-of-line single-step execution. The issue causes the kernel to l...

CVE-2026-98888 arm64: kprobes: Allow reentering kprobes while single-stepping

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBEHITSS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe ...

CVE-2026-98887 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO hwsimtxinfoframereceivednl casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries 8 bytes from it. The policy only...

CVE-2026-98887 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO hwsimtxinfoframereceivednl casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries 8 bytes from it. The policy only...

EUVD-2026-108681

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO hwsimtxinfoframereceivednl casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries 8 bytes from it. The policy only...

CVE-2026-98887

The Linux kernel contains a vulnerability in the wifi: mac80211_hwsim component. The function hwsim_tx_info_frame_received_nl() incorrectly handles the HWSIM_ATTR_TX_INFO payload by casting it to a struct hwsim_tx_rate * and reading 8 bytes of IEEE80211_TX_MAX_RATES entries. Because the policy on...

CVE-2026-98886 drm/gma500: return errors from Oaktrail HDMI I2C reads

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98886

The Linux kernel contains a vulnerability in the drm/gma500 driver related to Oaktrail HDMI I2C reads. The xfer_read() function improperly handles the wait_for_completion_interruptible_timeout() function by ignoring timeout and signal returns. If the interrupt fails to advance the transaction sta...

CVE-2026-98886 drm/gma500: return errors from Oaktrail HDMI I2C reads

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

EUVD-2026-108680

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98885 ima: return error early if file xattr cannot be changed

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

CVE-2026-98885

The Linux kernel contains a vulnerability in the ima (Integrity Measurement Architecture) subsystem where it fails to handle read-only filesystems correctly during early boot. Specifically, when the system attempts to change xattrs (extended attributes) on an ext4 filesystem that is currently rea...

EUVD-2026-108679

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

CVE-2026-98885 ima: return error early if file xattr cannot be changed

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

EUVD-2026-108678

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

CVE-2026-98884

The Linux kernel contains a vulnerability in the mmc core where an excessively large max_segs value provided by a host driver can be truncated to zero. This causes mmc_alloc_sg() to request a zero-sized allocation via kmalloc_objs(), returning a ZERO_SIZE_PTR under the SLUB allocator. Subsequent ...

CVE-2026-98884 mmc: core: Add validation for host-provided max_segs

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

CVE-2026-98884 mmc: core: Add validation for host-provided max_segs

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

CVE-2026-98883 serial: 8250_port: recognize UPIO_AU

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...

EUVD-2026-108677

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...