CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

CVE-2026-98694

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix KASAN reported use-after-free when request is canceled Alan reported that when doing stress testing sometimes KASAN notices use-after-free during control channel operation stripped down keeping the relevant parts...

CVE-2026-98706

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drain PS delivery work during station teardown Removing an AP or mesh station can notify the driver and wake TXQs after the station has already been removed from the driver, and can update numstaps and the...

CVE-2026-98643

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98698

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload filsencryptassocreq accepts a ReAssociation Request frame whose last element is the FILS Session element. cryptlen is then zero and aessivencrypt is called with an emp...

CVE-2026-98680

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Prevent memory leak and fix state The driver allocates memory for samples at buffer enable path. If regmap operation fails in the kx022afifoenable at the buffer enable path, the allocated memory is neve...

CVE-2026-98721

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending...

CVE-2026-98665

In the Linux kernel, the following vulnerability has been resolved: iio: health: max30102: fix NULL dereference in interrupt handler The interrupt is requested in max30102probe and stays enabled for the lifetime of the device, but indiodev-activescanmask is only valid while a buffer is enabled...

CVE-2026-98659

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

CVE-2026-98653

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix gaccessshadowfault In some circumstances, it is possible that the page of nested guest memory that is being shadowed is not present at all in the parent guest gmap. datentrywalk will not find any leaf entry and...

CVE-2026-98635

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98693

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Hold a router reference for each allocated HopID tbstop drops the reference to all DP tunnels but does not deactivate them, thus nothing cancels a dprxwork still in flight which holds its own tunnel reference and the...

CVE-2026-98621

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98614

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid livelock while updating retransmit path sctpassocupdateretranpath can loop forever when every remaining transport, including retranpath, is SCTPUNCONFIRMED: the state check runs before the wraparound test, so the loop...

CVE-2026-98642

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

CVE-2026-98605

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98632

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98563

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98558

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...