CVE-2026-98546 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

EUVD-2026-103590

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98545

The Linux kernel is vulnerable to an out-of-bounds read and write in the libata-scsi component. Specifically, when an ATA PASS-THROUGH command to an ATAPI device fails, the ata_scsi_set_passthru_sense_fields() function incorrectly trusts the additional length byte (sb[7] ) of the REQUEST SENSE re...

EUVD-2026-103589

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98544 bna: prevent IOC timer rearm during teardown

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98544

The Linux kernel contains a vulnerability where the bnad_pci_remove() and probe disable_ioceth paths fail to properly handle the iocpf_timer . While other timers are removed via timer_delete_sync() , the iocpf_timer remains active, leading bnad_iocpf_timeout() to attempt to take the bnad->bna_...

EUVD-2026-103587

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

EUVD-2026-103588

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

CVE-2026-98543 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

CVE-2026-98542 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98543

A vulnerability exists in the Linux kernel where bpf_lsm_has_d_inode_locked() incorrectly assumes the inode is locked during path_unlink and path_rmdir hooks. Because security_path_unlink() and security_path_rmdir() execute before the i_rwsem is acquired, a sleepable BPF LSM program can mutate ex...

CVE-2026-98542

The Linux kernel is affected by a vulnerability in cgroup/cpuset where the remote_partition_enable() function fails to properly handle subpartitions_cpus conflicts. Specifically, when a remote partition is created under an existing local partition via a non-partition intermediate cgroup, the kern...

EUVD-2026-103586

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541

The Linux kernel contains a vulnerability where omitting the FOU_ATTR_IPPROTO attribute when sending a FOU_CMD_ADD request with FOU_ENCAP_DIRECT causes fou_create() to initialize the protocol to 0. Because fou_udp_recv() returns 0 when the protocol is 0, it informs the UDP tunnel layer that the s...

EUVD-2026-103585

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

CVE-2026-98540

The Linux kernel contains a vulnerability where fprobe_fgraph_entry() reserves shadow stack space but fails to clear the area if the entry handler does not return 0. This allows fprobe_return() to incorrectly parse unused tail data as headers from previous calls, potentially causing an exit handl...

CVE-2026-98539 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...