CVE-2026-98397

The Linux kernel contains a vulnerability in the platform/x86: x86-android-tablets driver. Specifically, in gpio_secondary_fwnode_init(), the acpi_bus_find_device_by_name() function returns a device reference that is dropped at the end of each iteration due to the __free(put_device) declaration. ...

CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...

CVE-2026-98398 locking/lockdep: Invalidate stale class_cache entries for zapped classes

In the Linux kernel, the following vulnerability has been resolved: locking/lockdep: Invalidate stale classcache entries for zapped classes syzbot reported a lockdep splat hitting DEBUGLOCKSWARNON1 in hlockclass due to an invalid classidx: WARNING: kernel/locking/lockdep.c:238 at...

EUVD-2026-101046

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98397 platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown

In the Linux kernel, the following vulnerability has been resolved: platform/x86: x86-android-tablets: hold device reference for secondary fwnode teardown In gpiosecondaryfwnodeinit, acpibusfinddevicebyname returns a device reference, but the local dev variable is declared with freeputdevice,...

CVE-2026-98398

The Linux kernel contains a vulnerability in the lockdep subsystem where stale class_cache entries are not invalidated when a lock class is zapped (e.g., during module unload or key unregistration). This occurs because zap_class() removes the class from the hash table but does not clear pointers ...

CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

CVE-2026-98396

The Linux kernel on PowerPC architecture contains a vulnerability where KUAP (Kernel User Access Prevention) is restored too early during the transition from kernel to user mode. Specifically, the GENERIC_ENTRY feature incorrectly triggered kuap_user_restore() within arch_exit_to_user_mode_prepar...

CVE-2026-98396 powerpc: Do not restore KUAP in arch_exit_to_user_mode_prepare()

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

EUVD-2026-101045

In the Linux kernel, the following vulnerability has been resolved: powerpc: Do not restore KUAP in archexittousermodeprepare KUAP means kernel cannot touch user memory unless it explicitly is enabled. In the kernel it should stay AMRKUAPBLOCKED. While returning to userspace just before RFI, kern...

CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit

In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...

CVE-2026-98394 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98394

The Linux kernel contains a vulnerability in af_unix where recv(0, MSG_PEEK) triggers a busy-wait in unix_stream_read_generic(). This occurs when a blocking recv() is called and the final socket buffer (skb) in the queue is an MSG_OOB skb, but manage_oob() returns NULL for a 0-length buffer. The ...

CVE-2026-98395 powerpc/entry: Fix irq_soft_mask corruption on replayed interrupt exit

In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...

EUVD-2026-101044

In the Linux kernel, the following vulnerability has been resolved: powerpc/entry: Fix irqsoftmask corruption on replayed interrupt exit When replaysoftinterrupts replays a pending interrupt e.g. PACAIRQDEC - timerinterrupt, it calls the handler directly with a synthetic ptregs. The...

CVE-2026-98395

The Linux kernel contains a vulnerability in the powerpc architecture's interrupt handling. When __replay_soft_interrupts() replays a pending interrupt, the arch_local_irq_disable() function call unconditionally overwrites the irq_soft_mask with IRQS_DISABLED (0x1), stripping the IRQS_PMI_DISABLE...

CVE-2026-98394 af_unix: Return immediately when manage_oob() returns NULL for 0-length buffer.

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

EUVD-2026-101043

In the Linux kernel, the following vulnerability has been resolved: afunix: Return immediately when manageoob returns NULL for 0-length buffer. Fahad Alharbi reported that recv0, MSGPEEK triggers busy-wait in unixstreamreadgeneric if recv is blocking and the last skb in the queue is MSGOOB skb. I...

CVE-2026-98392

The Linux kernel contains a bounds off-by-one vulnerability within the Bluetooth btintel_pcie driver. The issue exists in the btintel_pcie_msix_tx_handle() function, where the check for tfd_index incorrectly allows an out-of-range index. Specifically, because valid indices for txq->urbd0s/tfds...

CVE-2026-98393 net: ipv4: Fix UDP length overflow with PMTU discover and big MTU

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...