CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98635

The Linux kernel contains an out-of-bounds write vulnerability in the scsi block layer during zone reporting. The blk_revalidate_disk_zones() function sizes the zones_cond array based on disk capacity and zone size, but blk_revalidate_zone_cond() uses an index from the device-driven report_zones(...

EUVD-2026-103549

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

EUVD-2026-103548

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-98634

The Linux kernel contains a vulnerability in the scsi: sd_zbc component where sd_zbc_read_zones() uses 64-bit arithmetic to compute zone counts but stores them in an unsigned int field. This results in silent truncation for counts exceeding 32 bits, causing the system to use incorrect values for ...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

EUVD-2026-103547

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...

CVE-2026-98633 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...

CVE-2026-98633

The Linux kernel contains a memory leak vulnerability in the Bluetooth btnxpuart component within the nxp_process_fw_dump() function. When CONFIG_DEV_COREDUMP is disabled, the hci_devcd_append() function returns -EOPNOTSUPP without freeing its skb argument , resulting in a leaked cloned skb. This...

CVE-2026-98633 Bluetooth: btnxpuart: Fix skb leak in nxp_process_fw_dump()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...

CVE-2026-98632 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98632 Bluetooth: mgmt: Dequeue pending mesh_send_sync entries on cancel

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98632

A use-after-free vulnerability exists in the Linux kernel Bluetooth management component. The issue occurs because send_cancel() frees mesh_tx objects via mesh_send_complete() while the hdev->cmd_sync_work_list may still retain a raw pointer to those objects. When hci_cmd_sync_work processes t...

EUVD-2026-103546

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: Dequeue pending meshsendsync entries on cancel In sendcancel, pending meshtx objects are removed from the hdev-meshpending list and freed via meshsendcomplete. However, if a mesh transmission was already queued...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

EUVD-2026-103545

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98631

The Linux kernel contains a vulnerability in the xsk component within the xsk_map_gen_lookup() function. The root cause is the use of BPF_JMP_IMM to compare a 32-bit key against max_entries. Because BPF immediates are sign-extended to 64 bits, a max_entries value of 0x80000000 or higher creates a...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...