EUVD-2026-103968

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Update control fields on VMEXIT if and only if VMRUN succeeded Leave control.erapctl and control.clean as-is in the VMCS if VMRUN fails, because as per AMD: there's no explicit architectural guarantee about the behavior...

EUVD-2026-103969

In the Linux kernel, the following vulnerability has been resolved: KVM: SVM: Preserve TLB control i.e. pending TLB flush on failed VMRUN Don't reset the VMCB's TLB control back to "do nothing" on a failed VMRUN, as empirical testing shows that the CPU performs the requested TLB flush if and only...

CVE-2026-98715

The Linux kernel contains a vulnerability in KVM 's SVM implementation where the VMCB's TLB control (pending TLB flush) is incorrectly reset to "do nothing" upon a failed VMRUN . Because the CPU only performs the flush if VMRUN succeeds, clearing this control effectively drops the requested TLB f...

CVE-2026-98713 KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

CVE-2026-98713

The Linux kernel addresses a vulnerability in KVM arm64 related to fine-grained UNDEFs (FGUs). The issue was caused by gating FGU trap configuration insertion on FEAT_FGT hardware support, even though FGUs do not require it. The fix ensures FGUs are applied consistently because kvm_calculate_trap...

EUVD-2026-103967

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Apply the fine-grained UNDEFs without FEATFGT FGUs don't actually require hardware support, so don't gate fgt trap config insertion on FGT. This is the only action required to allow FGUs always, as kvmcalculatetraps...

EUVD-2026-103965

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

CVE-2026-98711

The Linux kernel contains a vulnerability in the wifi: cw1200 driver where the TX path rounds the transfer size up to the bus alignment (up to 511 bytes for SDIO, 1 byte for SPI) but fails to reserve room in the frame buffer for the padding. This causes cw1200_data_write() to perform an out-of-bo...

CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

EUVD-2026-103966

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

EUVD-2026-103964

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710

The Linux kernel contains a memory leak vulnerability in the wifi: iwlegacy: 3945 driver. Specifically, while the il3945_pci_probe() function calls il_eeprom_init() to allocate memory for EEPROM data, the remove path fails to release this memory after a successful probe. This results in EEPROM da...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98709

A vulnerability exists in the Linux kernel 's wifi: mac80211 component. The function ieee80211_vif_use_reserved_switch() incorrectly validates replacements by counting assigned links too broadly, allowing a link to remain assigned to an old channel context while holding a reservation for a differ...

CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

EUVD-2026-103963

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...