CVE-2026-98408

In the Linux kernel, the following vulnerability has been resolved: watchdog: rzv2h: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-98407

The Linux kernel contains a heap Out-of-Bounds (OOB) write vulnerability in the wifi: rsi component. The issue occurs within the rsi_hal_load_key() function when a key is removed (where data == NULL). Because the set_key pointer is typed as struct rsi_set_key *, the subscripting operation scales ...

CVE-2026-98406

The Linux kernel contains a vulnerability in the mac80211 WiFi stack where the ieee80211_set_bitrate_mask() function fails to verify if an interface is still present in the driver before calling drv_set_bitrate_mask(). This occurs because the function checks if the interface is running but ignore...

EUVD-2026-101055

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in setbitratemask when sdata not in driver ieee80211setbitratemask checks if the interface is running via ieee80211sdatarunning, but it does not check if the interface is still present in the driver. Wh...

CVE-2026-98406 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in setbitratemask when sdata not in driver ieee80211setbitratemask checks if the interface is running via ieee80211sdatarunning, but it does not check if the interface is still present in the driver. Wh...

CVE-2026-98406 wifi: mac80211: avoid WARN in set_bitrate_mask when sdata not in driver

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: avoid WARN in setbitratemask when sdata not in driver ieee80211setbitratemask checks if the interface is running via ieee80211sdatarunning, but it does not check if the interface is still present in the driver. Wh...

CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98407 wifi: rsi: fix heap OOB write on key removal

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

EUVD-2026-101056

In the Linux kernel, the following vulnerability has been resolved: wifi: rsi: fix heap OOB write on key removal When a key is removed data == NULL, rsihalloadkey runs: memset&setkeyFRAMEDESCSZ, 0, framelen - FRAMEDESCSZ; setkey is a struct rsisetkey , so the subscript is scaled by sizeofstruct...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

EUVD-2026-101054

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98405

The Linux kernel contains a vulnerability in the smb client component within the parse_posix_sids() function. The issue stems from a missing iov bounds check , where sidsbuf_end is calculated using a server-supplied out_len without being validated against the actual iov_len. This allows a malicio...

CVE-2026-98405 smb: client: fix missing iov bounds check in parse_posix_sids()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix missing iov bounds check in parseposixsids In parseposixsids, sidsbufend is calculated using the server-supplied outlen without being validated against the actual length of the received iov iovlen. If a server...

CVE-2026-98404

A vulnerability was identified in the Linux kernel within the drm/virtio component. The function virtio_gpu_user_framebuffer_create() incorrectly returned NULL in certain scenarios, which led to a NULL pointer dereference in drm_mode_addfb2(). The issue has been resolved by ensuring the function ...

EUVD-2026-101053

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...

CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...

CVE-2026-98404 drm/virtio: Fix a NULL vs ERR_PTR() bug in virtio_gpu_user_framebuffer_create()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: Fix a NULL vs ERRPTR bug in virtiogpuuserframebuffercreate Smatch complains that returning a NULL here will lead to a NULL pointer dereference in drmmodeaddfb2. Return an error pointer instead...

EUVD-2026-101052

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

CVE-2026-98403 s390/boot: Avoid IPL parameter append past command line

In the Linux kernel, the following vulnerability has been resolved: s390/boot: Avoid IPL parameter append past command line A command line may occupy all but the terminating byte of COMMANDLINESIZE. In that case appendiplblockparm passes a zero size to the IPL parameter conversion helpers and...

CVE-2026-98403

The Linux kernel contains a vulnerability in the s390/boot component where the append_ipl_block_parm() function can cause an out-of-bounds write . If a command line occupies nearly all of COMMAND_LINE_SIZE, the function passes a zero size to conversion helpers while pointing to a destination one ...