CVE-2026-98358

The Linux kernel contains a vulnerability in the IB/iser stack where the system fails to properly reject remote invalidations of unregistered directions. Specifically, iser_reg_mem_fastreg() leaves rdma_reg[ISER_DIR_OUT].desc as NULL for write commands with immediate data, while iser_dma_map_task...

CVE-2026-98358 IB/iser: reject a remote invalidation of an unregistered direction

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

EUVD-2026-93343

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

CVE-2026-98358 IB/iser: reject a remote invalidation of an unregistered direction

In the Linux kernel, the following vulnerability has been resolved: IB/iser: reject a remote invalidation of an unregistered direction A write command whose data is sent entirely as immediate data is not registered. iserregmemfastreg takes the DMA key path and leaves rdmaregISERDIROUT.desc at NUL...

CVE-2026-98356 RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...

EUVD-2026-93341

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...

CVE-2026-98356

The Linux kernel contains a vulnerability in the RDMA/bnxt_re driver. Specifically, the function bnxt_re_init_dcb_wq() fails to properly handle a failed memory allocation. This oversight results in the asynchronous DCB handler subsequently calling queue_work() on a NULL pointer , which can lead t...

CVE-2026-98356 RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...

CVE-2026-98355

The Linux kernel contains a vulnerability in the RDMA/rtrs component where a null pointer dereference can occur. Specifically, if init_path() fails in the client, the cleanup function rtrs_clt_close_conns() may attempt to call event tracing code using clt_path->kobj->name while that name is...

CVE-2026-98355 RDMA/rtrs: guard against null kobj name

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...

EUVD-2026-93340

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...

CVE-2026-98355 RDMA/rtrs: guard against null kobj name

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if initpath errors, the callee tries to clean up with rtrscltcloseconns. However, this can lead to calling the event tracing code with cltpath-kobj-name being NULL and thus...

CVE-2026-98346 wifi: cfg80211: don't get the radio mask for netdev-less wdevs

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98346

The Linux kernel contains a vulnerability in the cfg80211 component where the function cfg80211_calculate_bi_data() calls rdev_get_radio_mask() using wdev->netdev. Because wdev->netdev can be NULL for certain network device types, this leads to a crash in mac80211 . The fix involves inverti...

EUVD-2026-93331

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98346 wifi: cfg80211: don't get the radio mask for netdev-less wdevs

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98335 wifi: mac80211: abort chanswitch when leaving a mesh

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

EUVD-2026-93320

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...

CVE-2026-98335

The Linux kernel contains a vulnerability in the mac80211 wifi subsystem where the ieee80211_stop_mesh() function fails to properly abort a channel switch (CSA) when leaving a mesh. Because the function leaves CSA active while releasing the channel context, it results in a null-pointer dereferenc...

CVE-2026-98335 wifi: mac80211: abort chanswitch when leaving a mesh

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: abort chanswitch when leaving a mesh The code in ieee80211stopmesh leaves CSA active, but leaving the mesh released the channel context, so the CSA finalize work crashes: Oops: general protection fault, probably f...