CVE-2026-98318

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98319

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmpendingvblankevent leak in error path for outfenceptr When an outfenceptr is provided but DRMMODEPAGEFLIPEVENT is not set, a drmpendingvblankevent will be allocated. If later, there is an allocation failure or another...

CVE-2026-98316

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98315

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98314

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98313

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98312

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98311

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98308

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98306

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98304

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...

CVE-2026-98302

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

CVE-2026-98300

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98301

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

CVE-2026-98299

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98297

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

CVE-2026-98296

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98294

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...