CVE-2026-98853

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inetgsosegment or ipv6gsosegment for each nested IP header. encaplevel tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stac...

CVE-2026-98824

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98717

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98647

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix divide-by-zero in btfstructwalk When an access goes past the struct and the last member is a flexible array, btfstructwalk folds the offset back into a single element with off - moff % t-size, but never checks that the...

CVE-2026-98798

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98683

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98860

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

CVE-2026-98822

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211buildhdr, ieee80211lookuprasta uses stainfogetbss for all AP and AP VLAN frames, not only for control port frames. A...

CVE-2026-98811

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98820

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

CVE-2026-98708

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

CVE-2026-98799

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

CVE-2026-98661

In the Linux kernel, the following vulnerability has been resolved: iio: light: rohm-bu27034: Fix infinite delay on error When reading an integration-time fails, the code will use error code to compute the sleep time. Fix this by using the smallest integration time as a default if reading fails...

CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98741

In the Linux kernel, the following vulnerability has been resolved: ALSA: ua101: reject mismatched capture/playback packet sizes detectusbformat cross-checks bSubframeSize, bBitResolution and tSamFreq between the capture and playback interfaces, but never relates the two endpoints' wMaxPacketSize...

CVE-2026-98829

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98646

In the Linux kernel, the following vulnerability has been resolved: tcp: Skip condresched in inetcsklistenstop under BPF context bpfsockdestroy runs from the tcp iterator, under rcureadlock. If the sock is a listener that still has children in its accept queue, tcpabort ends up in inetcsklistenst...

CVE-2026-98849

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

CVE-2026-98560

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...