CVE-2026-98536 writeback: report a Tasks-RCU quiescent state per cgwb drain pass

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-98536 writeback: report a Tasks-RCU quiescent state per cgwb drain pass

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-98536

The Linux kernel contains a vulnerability where a worker draining a cgwb with millions of attached inodes fails to report a Tasks-RCU quiescent state during each drain pass. Due to how cond_resched() behaves on CONFIG_PREEMPTION kernels (specifically arm64 and x86 architectures in lazy mode), the...

EUVD-2026-103580

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98535 fsl/fman: Fix clk reference leak in read_dts_node()

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98535 fsl/fman: Fix clk reference leak in read_dts_node()

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98535

The Linux kernel contains a clock reference leak within the fsl/fman component in the read_dts_node() function. The issue occurs because of_clk_get() increments a clock's reference count, but the function fails to call clk_put() after reading the rate. Since the clock is not stored, the reference...

CVE-2026-98534 ipe: fix use-after-free when auditing a newly loaded policy

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

CVE-2026-98534

A use-after-free vulnerability exists in the Linux kernel within the ipe component. The issue occurs because new_policy() audits a policy after ipe_new_policyfs_node() publishes it and releases the new directory's inode lock . This allows a concurrent delete operation to free the policy while ipe...

CVE-2026-98534 ipe: fix use-after-free when auditing a newly loaded policy

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

EUVD-2026-103579

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

CVE-2026-98533 ipe: protect the dm-verity root hash with RCU

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

EUVD-2026-103578

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

CVE-2026-98533

A vulnerability was identified in the Linux kernel involving the dm-verity component. Specifically, the function ipe_bdev_setintegrity() incorrectly freed the old root hash when publishing a new one on ->preresume , while policy evaluation could still be dereferencing the old hash. The issue h...

CVE-2026-98533 ipe: protect the dm-verity root hash with RCU

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

CVE-2026-98532

The Linux kernel is vulnerable to an out-of-bounds read and write in the IPv6 processing logic. The ipv6_find_hdr() function walks the extension header chain but fails to check if the skip amount exceeds the packet length (skb->len). This allows the function to return an offset pointing past t...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

EUVD-2026-103577

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98531 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...