CVE-2026-99065 cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99065

The Linux kernel is affected by a CPU hotplug race condition within the cgroup/cpuset subsystem, specifically in the guarantee_active_cpus() function. The issue arises during CPU offline operations because the cpu_active_mask is updated in sched_cpu_deactivate() before cpuset_handle_hotplug() can...

CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99064 cipso: adjust cached option offsets when removing CIPSO

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

EUVD-2026-108730

In the Linux kernel, the following vulnerability has been resolved: cipso: adjust cached option offsets when removing CIPSO cipsov4skbuffdelattr removes the CIPSO bytes but does not adjust cached offsets for options that follow them. For example, with a valid 10-byte CIPSO option followed by a...

CVE-2026-99064

The Linux kernel contains a vulnerability in the CIPSO implementation where the cipso_v4_skbuff_delattr() function removes CIPSO bytes but fails to adjust the cached offsets for subsequent options. This discrepancy causes consumers like ip_forward_options() and __ip_options_echo() to access incor...

CVE-2026-99063 dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

EUVD-2026-108729

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99063

The Linux kernel contains a vulnerability in the dm ioctl handling where the get_result_buffer() function fails to verify the buffer size relative to the struct dm_ioctl trailing padding. This allows data_start to point seven bytes past the end of the buffer, leading to a slab-out-of-bounds read ...

CVE-2026-99063 dm ioctl: don't let data_start run past the buffer

In the Linux kernel, the following vulnerability has been resolved: dm ioctl: don't let datastart run past the buffer struct dmioctl has seven bytes of trailing padding, so the smallest buffer userspace is allowed to ask for, offsetofstruct dmioctl, data, is seven bytes shorter than sizeofstruct...

CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

EUVD-2026-108728

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062

The Linux kernel contains a vulnerability in the vsock/virtio component where virtio_transport_read_skb() incorrectly manages byte accounting. After a partial stream receive, the function dequeues a packet but passes the full pkt_len for both buf_used and peer credit counters, causing rx_bytes to...

CVE-2026-99061 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99061

The Linux kernel contains a race condition in the brcmfmac driver during P2P device removal. When the driver is removed while a user-space process (such as wpa_suppliant ) is exiting, the P2P device interface can be removed twice, leading to a kernel crash . Specifically, a race occurs between nl...

EUVD-2026-108727

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99061 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99060 wifi: mt76: mt7603: initialize global station WCID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

CVE-2026-99060 wifi: mt76: mt7603: initialize global station WCID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...