EUVD-2026-103548

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-98634

The Linux kernel contains a vulnerability in the scsi: sd_zbc component where sd_zbc_read_zones() uses 64-bit arithmetic to compute zone counts but stores them in an unsigned int field. This results in silent truncation for counts exceeding 32 bits, causing the system to use incorrect values for ...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

EUVD-2026-103547

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...

CVE-2026-98633 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...

CVE-2026-98633

The Linux kernel contains a memory leak vulnerability in the Bluetooth btnxpuart component within the nxp_process_fw_dump() function. When CONFIG_DEV_COREDUMP is disabled, the hci_devcd_append() function returns -EOPNOTSUPP without freeing its skb argument , resulting in a leaked cloned skb. This...

CVE-2026-98633 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...

CVE-2026-98632 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98632 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98632

A use-after-free vulnerability exists in the Linux kernel Bluetooth management component. The issue occurs because send_cancel() frees mesh_tx objects via mesh_send_complete() while the hdev->cmd_sync_work_list may still retain a raw pointer to those objects. When hci_cmd_sync_work processes t...

EUVD-2026-103546

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

EUVD-2026-103545

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98631

The Linux kernel contains a vulnerability in the xsk component within the xsk_map_gen_lookup() function. The root cause is the use of BPF_JMP_IMM to compare a 32-bit key against max_entries. Because BPF immediates are sign-extended to 64 bits, a max_entries value of 0x80000000 or higher creates a...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98630

The Linux kernel contains a vulnerability in the eth: fbnic component related to improper error cleanup. When a payload page pool allocation fails, the pointer is populated with an error pointer; however, the cleanup path incorrectly passes this error pointer to page_pool_destroy() instead of the...

EUVD-2026-103544

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...