CVE-2026-98824

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98823

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry can pass such an entry to cfg80211updateknownbss when...

CVE-2026-98822

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211buildhdr, ieee80211lookuprasta uses stainfogetbss for all AP and AP VLAN frames, not only for control port frames. A...

CVE-2026-98788

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98790

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98785

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98794

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98789

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98742

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Serialize compat port-info ioctls The native sequencer ioctl path serializes handler calls with client-ioctlmutex, but the translated port-info compat path invokes the same handlers through sndseqkernelclientctl withou...

CVE-2026-98743

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98787

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

CVE-2026-98793

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98792

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98784

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfxv60initmicrocode is not released when the GFX block is torn down, leaking the firmware resources. Add gfxv60freemicrocode and call it from gfxv60swfini t...

CVE-2026-98781

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex device via offinddevicebynode, without ever dropping it: mtkdrmunbin...

CVE-2026-98774

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98739

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix initial port reference race For RFCOMMRELEASEONHUP devices, rfcommttyinstall and rfcommreleasedev both use RFCOMMTTYOWNED to decide who drops the initial ttyport reference. The release path tests the bit...

CVE-2026-98722

In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erasesize is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice then evaluates if size % erasesize with a zero divisor, which triggers a...

CVE-2026-98724

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...