CVE-2026-98420 ksmbd: follow SMB2 session expiration semantics

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

EUVD-2026-101069

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

CVE-2026-98420

The Linux kernel 's ksmbd component contains a vulnerability where the ksmbd_session_register() function incorrectly destroys valid sessions after ten seconds of inactivity during a new SessionSetup exchange. This occurs because the system confuses Session.IdleTime with Session.ExpirationTime . T...

CVE-2026-98419 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

EUVD-2026-101068

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

CVE-2026-98418

The Linux kernel contains a logic issue where the sched/core component triggers a false positive migration warning for proxy donors . Specifically, set_task_cpu() warns unconditionally for migration-disabled tasks, but moving a blocked donor's scheduling context to a lock owner's CPU does not vio...

CVE-2026-98418 sched/core: Avoid false migration warning for proxy donors

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

EUVD-2026-101067

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

CVE-2026-98416

The Linux kernel contains a NULL dereference vulnerability within the dmaengine driver specifically affecting ti: k3-udma-glue . The issue occurs in the k3_udma_glue_release_rx_chn() function; if devm_kcalloc() fails to allocate rx_chn->flows , the error path triggers a dereference of the NULL...

EUVD-2026-101065

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98416 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98417

The Linux kernel contains a vulnerability where ESP-in-TCP can process xfrm packets with transport header offsets that no longer fit after the stream parser trims the TCP envelope. This issue occurs because the plain transport header reset truncates the offset, triggering the skb warning path . T...

EUVD-2026-101066

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98416 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98414 memcg: avoid charging the root memcg from obj_cgroup_charge_pages()

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98415

The Linux kernel contains a use-after-free vulnerability within the soc: samsung: exynos-pmu driver. Specifically, the setup_cpuhp_and_cpuidle() function incorrectly decrements the reference count of the interrupt generation block node using of_node_put() immediately after fetching the resource a...