CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

EUVD-2026-86973

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

CVE-2026-98142

The Linux kernel contains a vulnerability in the cirrus-qemu driver where it fails to verify that the PCI BAR0 resource size matches the expected CIRRUS_VRAM_SIZE (4 MB) during the probe process. If a device with a BAR0 smaller than 4 MB is bound, the driver may allow the creation of framebuffers...

CVE-2026-98142 drm/cirrus-qemu: Validate BAR0 size during probe

In the Linux kernel, the following vulnerability has been resolved: drm/cirrus-qemu: Validate BAR0 size during probe The cirrus-qemu driver relies on CIRRUSVRAMSIZE 4 MB to validate framebuffer sizes. However, during PCI probe, the driver mapped BAR0 without verifying that its size matches...

CVE-2026-98119 netfs: break unbuffered write when netfs_alloc_subrequest() fails

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

EUVD-2026-86950

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

EUVD-2026-86915

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98085

The Linux kernel contains a vulnerability in the BPF precision backtracking mechanism affecting BPF_LD | BPF_{IND,ABS} instructions. The root cause is that the backtrack_insn() function fails to handle the implicit exit case from a subprogram. Specifically, it does not call bt_subprog_enter() whe...

CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

EUVD-2026-86652

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspac...

CVE-2026-97998 netfilter: nfnetlink_log: cope with concurrent instance destruction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspac...

CVE-2026-97998 netfilter: nfnetlink_log: cope with concurrent instance destruction

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspac...

CVE-2026-97998

A vulnerability exists in the Linux kernel 's netfilter: nfnetlink_log component where instances are refcounted, but memory release only occurs during a 1 -> 0 transition , while unlinking from hashes can happen at any refcount. Uncooperative userspace can trigger a race condition by forcing a...

CVE-2026-97906

The Linux kernel is affected by an integer overflow vulnerability within the get_boot_config_from_initrd() function. A crafted initrd with an excessively large bootconfig size (e.g., 0xFFFFFFFF) causes pointer arithmetic to wrap around, specifically when calculating data = ((void *)hdr) - size. T...

EUVD-2026-86760

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

EUVD-2026-86743

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

CVE-2026-97570

The Linux kernel contains a vulnerability in the bnxt_en driver where 57608 NICs with firmware version 233 can experience a crash at boot . The issue arises because the bnxt_alloc_agg_idx function can produce a software ID exceeding the 32 entries allocated for rx_tpa, leading to an out-of-bounds...