CVE-2026-98087 sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

EUVD-2026-86917

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

CVE-2026-98087

The Linux kernel contains a vulnerability where the RT balancer enters a retry loop when handling migrate_disable() 'd Real-Time (RT) tasks. Because these tasks remain on the pushable list while being pinned, the scheduler repeatedly attempts to push them, fails, and falls back to pushing the cur...

CVE-2026-98081

A vulnerability exists in the Linux kernel 's btrfs filesystem involving the zoned feature. The root cause is that do_zone_finish() clears the BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE flag but returns early if call_zone_finish() fails. This results in a reference leak for inactive block groups on fs_info-...

EUVD-2026-86911

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-98081

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-98081 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-98081 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-98075 bpf: reject BPF_PSEUDO_FUNC reference to the main program

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

CVE-2026-98072 net/rds: use wq_has_sleeper() in release_in_xmit()

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

CVE-2026-98072

The Linux kernel contains a vulnerability in the net/rds component where the release_in_xmit() function fails to maintain necessary memory ordering. Specifically, it uses clear_bit_unlock() to clear RDS_IN_XMIT, which lacks the full barrier required for a subsequent load of the wait queue head. T...

EUVD-2026-86709

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

CVE-2026-98056 nvme: remove stale namespaces by NSID range during scan

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

CVE-2026-98056 nvme: remove stale namespaces by NSID range during scan

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

CVE-2026-98056

The Linux kernel contains a vulnerability in the nvme driver where the nvme_scan_ns_list() function inefficiently processes stale namespaces. Specifically, it drops stale namespaces in gaps by iterating through every individual NSID one at a time. Because NSIDs are 32-bit, a sparse NSID space can...

EUVD-2026-86685

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage to handle t...

CVE-2026-98032 tracing: Fix subbuf resize races with trace_pipe_raw readers

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage to handle t...

CVE-2026-98029

The Linux kernel contains a vulnerability in the nfp driver where the nfp_net_get_fs_loc() function fails to check the cmd->rule_cnt when dumping entries into the rule_locs[] buffer. Because ETHTOOL_GRXCLSRLALL does not require CAP_NET_ADMIN privileges and uses a user-supplied rule_cnt to size...

EUVD-2026-86680

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98027 net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...