CVE-2026-98501 HID: alps: fix use-after-free on input2 registration failure

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

CVE-2026-98501

The Linux kernel contains a use-after-free vulnerability in the HID: alps driver. The issue occurs in alps_input_configured() because data->input2 is stored before input_register_device() is called; if registration fails, input_free_device() frees the device while data->input2 still points ...

CVE-2026-98501 HID: alps: fix use-after-free on input2 registration failure

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

EUVD-2026-103741

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

CVE-2026-98500 HID: hid-oxp: use cancel_delayed_work_sync() in remove

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

CVE-2026-98500 HID: hid-oxp: use cancel_delayed_work_sync() in remove

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

EUVD-2026-103740

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

CVE-2026-98500

The Linux kernel contains a vulnerability in the hid-oxp driver. The oxp_hid_remove() function incorrectly uses cancel_delayed_work() for three delayed work items. Because this function only dequeues pending items without waiting for active callbacks to finish, any running callbacks—specifically ...

CVE-2026-98499 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

CVE-2026-98499

The Linux kernel contains an out-of-bounds (OOB) read vulnerability within the HID wacom driver, specifically in the wacom_wac_pen_serial_enforce() function. The issue occurs because the function may calculate an invalid offset when calling hid_field_extract() if a HID descriptor lists more usage...

EUVD-2026-103739

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

CVE-2026-98499 HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

CVE-2026-98498

The Linux kernel contains a memory leak vulnerability in the net/mlx5 driver within the mlx5_tc_ct_shared_counter_get() function. The issue occurs when a reverse entry is identified but its counter is already being released; in this scenario, refcount_inc_not_zero() fails, causing the reference t...

CVE-2026-98498 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

EUVD-2026-103738

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

CVE-2026-98498 net/mlx5: Fix rev_entry reference leak in mlx5_tc_ct_shared_counter_get()

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

CVE-2026-98497

The Linux kernel contains a vulnerability in the net/mlx5e driver where IPv6 IPsec policy masks are swapped. Specifically, while mlx5e_ipsec_policy_mask() builds masks independently, setup_fte_addr6() incorrectly installs them into opposite address fields. When IPv6 XFRM policies use different so...

CVE-2026-98497 net/mlx5e: fix swapped IPv6 IPsec policy masks

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...

EUVD-2026-103737

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...

CVE-2026-98497 net/mlx5e: fix swapped IPv6 IPsec policy masks

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...