EUVD-2026-103559

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

CVE-2026-98645 HID: winwing: fix use-after-free in force feedback teardown

In the Linux kernel, the following vulnerability has been resolved: HID: winwing: fix use-after-free in force feedback teardown winwinginitff passes the driver's private data, allocated with devmkzalloc in winwingprobe, as the effect context to inputffcreatememless. The memoryless force-feedback...

CVE-2026-98644 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

EUVD-2026-103558

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

CVE-2026-98644 bpf: Avoid soft lockup in __htab_map_lookup_and_delete_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: Avoid soft lockup in htabmaplookupanddeletebatch htabmaplookupanddeletebatch has no rescheduling point. The batch count bounds how many entries are copied out, not how many buckets are visited, so one BPFMAPLOOKUPBATCH call...

CVE-2026-98644

The Linux kernel contains a vulnerability in the BPF subsystem within the __htab_map_lookup_and_delete_batch() function. The root cause is a lack of rescheduling points; a single BPF_MAP_LOOKUP_BATCH call can traverse a large hash map end-to-end, especially during consecutive empty bucket travers...

CVE-2026-98643

The Linux kernel is vulnerable to an out-of-bounds read within the bpf subsystem. Specifically, a sockops program reading skops->rtt_min fails to verify the socket type. On the tcp_conn_request() path, sock_ops->sk is a request_sock (non-full), but the context rewrite incorrectly casts it t...

CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

EUVD-2026-103557

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

EUVD-2026-103556

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

CVE-2026-98642

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the bpf memalloc component. The root cause is a lack of synchronization protecting llist_del_all() during __free_rcu() callbacks, which allows concurrent execution of alloc_bulk() to operate on the waiting_for_gp_ttrace list. T...

CVE-2026-98642 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

CVE-2026-98642 bpf: Fix UAF due to concurrent consumption of ttrace lists in alloc_bulk

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix UAF due to concurrent consumption of ttrace lists in allocbulk Syzkaller repeatedly triggered UAF splats related to nodes in waitingforgpttrace within the bpf memalloc: BUG: KASAN: slab-use-after-free in...

CVE-2026-98641

The Linux kernel contains a vulnerability affecting BPF on arm64 architectures. The issue arises when a program acts as an exception boundary and saves all callee-saved registers, causing the kernel to fail to correctly set the frame pointer (BPF_REG_FP) for the exception callback. Because the ca...

CVE-2026-98641 bpf, arm64: set up the frame pointer for the exception callback

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

CVE-2026-98641 bpf, arm64: set up the frame pointer for the exception callback

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

EUVD-2026-103555

In the Linux kernel, the following vulnerability has been resolved: bpf, arm64: set up the frame pointer for the exception callback A program acting as exception boundary saves all callee-saved registers, so buildprologue takes the exceptioncb path and never calls pushcalleeregs. That is the only...

EUVD-2026-103554

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

CVE-2026-98640

The Linux kernel contains a vulnerability in the amd_sfh driver where it maps PCI BAR 2 using pcim_iomap_regions() without validating if the BAR size is sufficient for subsequent MMIO register accesses (up to offset 0x10958). If the driver binds to a device with a smaller BAR 2, it results in an ...