CVE-2026-98639 KVM: riscv: Fix NACL hfence entry update order

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

CVE-2026-98639 KVM: riscv: Fix NACL hfence entry update order

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

CVE-2026-98639

The Linux kernel contains a vulnerability in the KVM module related to riscv architecture. The function __kvm_riscv_nacl_hfence() incorrectly writes the Config word before updating the Page_Number and Page_Count words. This violates the SBI v3.0 specification and allows the SBI implementation or ...

EUVD-2026-103553

In the Linux kernel, the following vulnerability has been resolved: KVM: riscv: Fix NACL hfence entry update order The SBI v3.0 specification section 15.1.2 requires a nested HFENCE entry to be populated as follows: 1 find an unused entry with Config.Pending == 0 2 update the PageNumber and...

EUVD-2026-103552

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve pkvmvcpuinitsve clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl and the WARNON there, which is fatal ...

CVE-2026-98638 KVM: arm64: Validate the SVE vector length in pkvm_vcpu_init_sve()

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Validate the SVE vector length in pkvmvcpuinitsve pkvmvcpuinitsve clamps only the upper bound of the host-provided svemaxvl, so an invalid vector length reaches svestatesizefromvl and the WARNON there, which is fatal ...

EUVD-2026-103551

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Do not clear VM-wide SVE feature on vCPU init failure pkvmvcpuinitsve clears KVMARMVCPUSVE in kvm-arch.vcpufeatures when it fails, but vcpuhassve tests KVMARCHFLAGGUESTHASSVE, which is left set. Later vCPUs on that VM...

CVE-2026-98636 squashfs: Add dictionary size range check to prevent shift-out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image COMPOPTS flag is 1 but dictionary size is 0 is mounted, and performs shift operations using dictionarysize, the shift expone...

CVE-2026-98636

The Linux kernel contains a vulnerability in the squashfs module where mounting an abnormal SquashFS image (with COMP_OPTS set to 1 but a dictionary size of 0) triggers a shift-out-of-bounds error. This occurs because the shift exponent $n$ becomes -1, leading to an invalid shift operation during...

EUVD-2026-103550

In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image COMPOPTS flag is 1 but dictionary size is 0 is mounted, and performs shift operations using dictionarysize, the shift expone...

CVE-2026-98636 squashfs: Add dictionary size range check to prevent shift-out-of-bounds

In the Linux kernel, the following vulnerability has been resolved: squashfs: Add dictionary size range check to prevent shift-out-of-bounds When an abnormal SquashFS image COMPOPTS flag is 1 but dictionary size is 0 is mounted, and performs shift operations using dictionarysize, the shift expone...

CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98635

The Linux kernel contains an out-of-bounds write vulnerability in the scsi block layer during zone reporting. The blk_revalidate_disk_zones() function sizes the zones_cond array based on disk capacity and zone size, but blk_revalidate_zone_cond() uses an index from the device-driven report_zones(...

EUVD-2026-103549

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

EUVD-2026-103548

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-98634

The Linux kernel contains a vulnerability in the scsi: sd_zbc component where sd_zbc_read_zones() uses 64-bit arithmetic to compute zone counts but stores them in an unsigned int field. This results in silent truncation for counts exceeding 32 bits, causing the system to use incorrect values for ...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

EUVD-2026-103547

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Fix skb leak in nxpprocessfwdump When CONFIGDEVCOREDUMP=n, hcidevcdappend returns -EOPNOTSUPP without freeing its skb argument. This leaks the cloned skb and also prevents nxpsetindreset from being called to...