CVE-2026-98400 s390/ipl: Fix NULL deref in kdump without re-IPL parm block

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...

CVE-2026-98400

The Linux kernel contains a NULL pointer dereference vulnerability within the s390/ipl subsystem during kdump operations. The issue occurs because certain IPL types, such as HMC FTP boot or QEMU direct kernel boot , do not provide an IPL parameter block, leaving reipl_block_actual as NULL . A pre...

CVE-2026-98399

The Linux kernel contains a vulnerability in the s390/ipl component where the dump_reipl_run() function performs a NULL dereference when an IPL parameter block is missing. This occurs with specific IPL types, such as HMC FTP boot or QEMU direct kernel boot , because reipl_block_actual remains NUL...

CVE-2026-98399 s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in dumpreipl without re-IPL parm block Unlike kdump, which passes the re-IPL parameter block through osinfo, the stand-alone dump passes it through the IPL parm block address and checksum in lowcore. Some...

CVE-2026-98400 s390/ipl: Fix NULL deref in kdump without re-IPL parm block

In the Linux kernel, the following vulnerability has been resolved: s390/ipl: Fix NULL deref in kdump without re-IPL parm block Some IPL types, like HMC FTP boot or QEMU direct kernel boot, might not provide an IPL parameter block. In this case, reipltypeinit selects IPLTYPEUNKNOWN, and...

EUVD-2026-101046

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98397

The Linux kernel contains a vulnerability in the platform/x86: x86-android-tablets driver. Specifically, in gpio_secondary_fwnode_init(), the acpi_bus_find_device_by_name() function returns a device reference that is dropped at the end of each iteration due to the __free(put_device) declaration. ...

CVE-2026-98398

The Linux kernel contains a vulnerability in the lockdep subsystem where stale class_cache entries are not invalidated when a lock class is zapped (e.g., during module unload or key unregistration). This occurs because zap_class() removes the class from the hash table but does not clear pointers ...

CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...

EUVD-2026-101047

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...

CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...

CVE-2026-98396

The Linux kernel on PowerPC architecture contains a vulnerability where KUAP (Kernel User Access Prevention) is restored too early during the transition from kernel to user mode. Specifically, the GENERIC_ENTRY feature incorrectly triggered kuap_user_restore() within arch_exit_to_user_mode_prepar...

CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

EUVD-2026-101045

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit

In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...

CVE-2026-98394 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...