EUVD-2026-103587

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98542 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98542

The Linux kernel is affected by a vulnerability in cgroup/cpuset where the remote_partition_enable() function fails to properly handle subpartitions_cpus conflicts. Specifically, when a remote partition is created under an existing local partition via a non-partition intermediate cgroup, the kern...

CVE-2026-98543

A vulnerability exists in the Linux kernel where bpf_lsm_has_d_inode_locked() incorrectly assumes the inode is locked during path_unlink and path_rmdir hooks. Because security_path_unlink() and security_path_rmdir() execute before the i_rwsem is acquired, a sleepable BPF LSM program can mutate ex...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

EUVD-2026-103586

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541

The Linux kernel contains a vulnerability where omitting the FOU_ATTR_IPPROTO attribute when sending a FOU_CMD_ADD request with FOU_ENCAP_DIRECT causes fou_create() to initialize the protocol to 0. Because fou_udp_recv() returns 0 when the protocol is 0, it informs the UDP tunnel layer that the s...

CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

CVE-2026-98540

The Linux kernel contains a vulnerability where fprobe_fgraph_entry() reserves shadow stack space but fails to clear the area if the entry handler does not return 0. This allows fprobe_return() to incorrectly parse unused tail data as headers from previous calls, potentially causing an exit handl...

CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

EUVD-2026-103585

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

CVE-2026-98539

The Linux kernel 's ntfs3 filesystem component contains a vulnerability where ntfs_create_inode() incorrectly interacts with d_instantiate() . Specifically, calling unlock_new_inode() after d_instantiate() causes lockdep_annotate_inode_mutex_key() to reset the i_rwsem count and owner while anothe...

CVE-2026-98539 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

EUVD-2026-103584

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

CVE-2026-98539 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

EUVD-2026-103583

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...

CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98538

The Linux kernel contains a performance issue in the writeback subsystem where the cleanup_offline_cgwb() function performs a quadratic drain of inodes. This occurs because the function repeatedly walks wb->b_attached and wb->b_dirty_time from the same end, causing it to rescanned a growing...

CVE-2026-98537

The Linux kernel contains a vulnerability in the workqueue subsystem where the check_flush_dependency() function performs a NULL pointer dereference . The issue occurs because current_wq_worker() confirms the process is a workqueue worker, but the worker->current_pwq pointer remains NULL if th...