EUVD-2026-103953

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...

CVE-2026-98698 wifi: mac80211: handle empty FILS association request payload

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...

EUVD-2026-103952

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...

CVE-2026-98698

The Linux kernel contains a vulnerability in the wifi: mac80211 component when handling a FILS association request frame where the last element is a FILS Session element. Specifically, the function fils_encrypt_assoc_req() may receive a zero-length crypt_len, causing aes_siv_encrypt() to be calle...

CVE-2026-98698 wifi: mac80211: handle empty FILS association request payload

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...

CVE-2026-98697 USB: serial: fix dynamic id driver deregistration race

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute...

EUVD-2026-103951

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute...

CVE-2026-98697

The Linux kernel contains a race condition vulnerability in the USB serial driver during dynamic id driver deregistration . The issue occurs because dynamic IDs are not properly freed after the driver is deregistered and the "new_id" attribute is removed, which can lead to a leak of IDs added dur...

CVE-2026-98697 USB: serial: fix dynamic id driver deregistration race

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix dynamic id driver deregistration race Only free the dynamic ids after having deregistered the driver and removed the "newid" attribute to avoid leaking any id added by a racing write to the attribute...

CVE-2026-98696 USB: serial: fix driver deregistration order

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

CVE-2026-98696

The Linux kernel contains a vulnerability in the USB serial driver modules related to the order of driver deregistration. When unloading a module, the USB driver must be deregistered before the USB serial bus drivers to ensure I/O stops before ports are unbound. Failure to follow this order can l...

EUVD-2026-103950

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

CVE-2026-98696 USB: serial: fix driver deregistration order

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix driver deregistration order USB serial driver modules register one driver for the USB bus and one or more drivers for the ports on the USB serial bus. When unloading a driver module, the USB driver must be...

CVE-2026-98695

The Linux kernel contains a race condition involving tty ioctls and the hangup operation for USB serial devices. The vulnerability occurs when a device is disconnected or powered down during lengthy break signaling, potentially causing the kernel to call into a tty driver for a non-existent devic...

EUVD-2026-103949

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

CVE-2026-98695 USB: serial: fix ioctl hangup race

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

CVE-2026-98695

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

CVE-2026-98695 USB: serial: fix ioctl hangup race

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

CVE-2026-98694

The Linux kernel contains a use-after-free vulnerability within the thunderbolt component during control channel operations. The issue occurs when a request is canceled; specifically, if tb_cfg_request_work() completes just before tb_cfg_request_cancel() starts, it may re-queue work for a request...