CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98347

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

CVE-2026-98205

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98271

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskbcarve pskbcarveinsideheader and pskbcarveinsidenonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the operation...

CVE-2026-98368

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98315

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98251

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98310

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98216

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

CVE-2026-98257

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

CVE-2026-98190

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix out-of-bounds read in P2P public action frames wilcwfip2prx and mgmttx start parsing a frame once ieee80211ispublicaction returns true. That helper only verifies the frame is long enough for the action categor...

CVE-2026-98306

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98324

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98308

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98351

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

CVE-2026-98354

In the Linux kernel, the following vulnerability has been resolved: RDMA/mad: Fix receive buffer leak when PKey enforcement fails ibmadcompleterecv initializes madrecvwc-rmpplist and then runs ibmadenforcesecurity before linking recvbuf onto that list. On failure it calls ibfreerecvmad, which onl...

CVE-2026-98366

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98259

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...