CVE-2026-99086 dm-integrity: validate the superblock on resume

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...

EUVD-2026-108936

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

CVE-2026-99085

The Linux kernel contains a vulnerability in sched_ext where a CPU hotplug hang can occur if a dying CPU's tasks are held by the BPF scheduler . The issue arises because tasks on a user DSQ are still counted on the runqueue (rq), but an inactive CPU stops calling ops.dispatch(), preventing tasks ...

CVE-2026-99085 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

CVE-2026-99085 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

EUVD-2026-108935

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084 readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084 readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084

The Linux kernel contains a vulnerability where iterate_dir() takes a directory's i_rwsem shared lock and holds it across iterate_shared() . This is particularly impactful for nullfs instances, where a shared inode across multiple mount namespaces can be used to cause a denial of service (DoS) . ...

CVE-2026-99083

The Linux kernel contains a heap out-of-bounds write vulnerability in the ksmbd component within the krb5_authenticate() function. The root cause is an incorrect calculation of out_len, which fails to account for work->next_smb2_rsp_hdr_off when SMB2_SESSION_SETUP is processed as a non-first e...

EUVD-2026-108934

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

EUVD-2026-108933

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvmmemslots...

CVE-2026-99081 bnxt_en: fix DMA mapping length for padded small packets

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...

EUVD-2026-108747

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...

CVE-2026-99081

The Linux kernel contains a vulnerability in the bnxt_en driver affecting BCM57412 NetXtreme-E NICs . When transmitting small packets (less than 52 bytes) on VLAN/macvlan interfaces, the driver incorrectly handles DMA mapping for padded frames. Specifically, the len variable remains unadjusted af...

CVE-2026-99081 bnxt_en: fix DMA mapping length for padded small packets

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...

CVE-2026-99080 fs: Free any excess xarray nodes in clear_inode()

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...

EUVD-2026-108746

In the Linux kernel, the following vulnerability has been resolved: fs: Free any excess xarray nodes in clearinode For many years we've had a hard to hit leak of xarray nodes. Hugh documented it well in commit 786b31121a2c. Recently people and syzbot have found ways to force it to happen with...