CVE-2026-99087 dm-integrity: fix NULL pointer dereference when the 'R' flag is used

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the device in the 'R' mode, a crash in dmintegrityresume happens because th...

EUVD-2026-108938

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: fix NULL pointer dereference when the 'R' flag is used If the dm-integrity device has the SBFLAGDIRTYBITMAP flag set and the user activates the device in the 'R' mode, a crash in dmintegrityresume happens because th...

CVE-2026-99086 dm-integrity: validate the superblock on resume

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...

CVE-2026-99086

A vulnerability exists in the Linux kernel within the dm-integrity component. The dm_integrity_resume() function re-reads the superblock from the device without validation, while in-memory structures are sized based on the validated superblock read during the constructor. An attacker can modify t...

CVE-2026-99086 dm-integrity: validate the superblock on resume

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...

EUVD-2026-108937

In the Linux kernel, the following vulnerability has been resolved: dm-integrity: validate the superblock on resume dmintegrityresume re-reads the superblock from the device so that it picks up the flags and the recalculate position. It performs no validation on the result, while the constructor...

CVE-2026-99085

The Linux kernel contains a vulnerability in sched_ext where a CPU hotplug hang can occur if a dying CPU's tasks are held by the BPF scheduler . The issue arises because tasks on a user DSQ are still counted on the runqueue (rq), but an inactive CPU stops calling ops.dispatch(), preventing tasks ...

CVE-2026-99085 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

CVE-2026-99085 sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

EUVD-2026-108936

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix CPU hotplug hang when a dying CPU's tasks sit in the BPF scheduler A CPU going down has to empty its own rq. Its hotplug thread waits in schedcpuwaitempty until nothing else is left, and the only thing that wakes it...

EUVD-2026-108935

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084 readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084 readdir: take no inode lock on an immutable directory

In the Linux kernel, the following vulnerability has been resolved: readdir: take no inode lock on an immutable directory iteratedir takes the directory's irwsem shared and holds it across -iterateshared. For a directory that never has an entry and is never removed the lock keeps nothing still, i...

CVE-2026-99084

The Linux kernel contains a vulnerability where iterate_dir() takes a directory's i_rwsem shared lock and holds it across iterate_shared() . This is particularly impactful for nullfs instances, where a shared inode across multiple mount namespaces can be used to cause a denial of service (DoS) . ...

CVE-2026-99083

The Linux kernel contains a heap out-of-bounds write vulnerability in the ksmbd component within the krb5_authenticate() function. The root cause is an incorrect calculation of out_len, which fails to account for work->next_smb2_rsp_hdr_off when SMB2_SESSION_SETUP is processed as a non-first e...

EUVD-2026-108934

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

CVE-2026-99083 ksmbd: fix heap out-of-bounds write in krb5_authenticate()

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix heap out-of-bounds write in krb5authenticate In krb5authenticate, outlen is calculated to determine available headroom in responsebuf for the incoming Kerberos AP-REP token. However, when SMB2SESSIONSETUP is processed ...

EUVD-2026-108933

In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Use active memslots for the per-vCPU MMIO cache KVM tags the per-vCPU MMIO cache with a memslot generation so that a memslot update invalidates cached MMIO information. Both the fill and validation paths use kvmmemslots...

EUVD-2026-108747

In the Linux kernel, the following vulnerability has been resolved: bnxten: fix DMA mapping length for padded small packets Stefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412 NetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces: DMAR: DMA Read NOPASID Request...