CVE-2026-98820

The Linux kernel contains a vulnerability in blk-mq where cached requests, initially allocated for one operation, could be reused for another. Specifically, if a passthrough command has RQF_USE_SCHED cleared, subsequent read/write bios might use these flags incorrectly. This results in requests b...

CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

EUVD-2026-103904

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819

The Linux kernel contains a vulnerability in the btintel Bluetooth driver regarding how it handles DDC record lengths . The root cause is that record lengths were parsed in a manner where the value 0xFF could wrap, potentially leading to incorrect processing. The fix involves parsing lengths in u...

CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

EUVD-2026-103903

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

CVE-2026-98818

The Linux kernel contains a deadlock vulnerability in the mm/slab component. The issue arises because kfree_rcu() can be called while holding the pi_lock (a raw spinlock in the scheduler). If kfree_rcu() attempts to allocate memory using __GFP_KSWAPD_RECLAIM , it can wake up kswapd , which then t...

CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

EUVD-2026-103902

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

CVE-2026-98817

The Linux kernel addressed an issue within the ASoC: SDCA component related to pm_runtime error handling. The vulnerability involved a missing common error path during the func probe process, which prevented the proper balancing of the runtime PM reference . The fix ensures that the reference is ...

CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

EUVD-2026-103901

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

CVE-2026-98816

The Linux kernel contains a vulnerability where an overflow of the jump offset occurs during constant blinding in the bpf subsystem. Specifically, the bpf_jit_blind_insn() function rewrites instructions and subtracts 2 from the jump offset off. Because off is a 16-bit signed integer, values such ...

CVE-2026-98815 nvme: fix cdev lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...