CVE-2026-98814

The Linux kernel contains a use-after-free vulnerability within the nvme_core component. The issue occurs when an I/O passthrough command is sent through a multipath namespace head after the controller path that initially created the head has been removed. KASAN identified the bug as a slab-use-a...

CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

EUVD-2026-103899

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

EUVD-2026-103898

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813

The Linux kernel contains a vulnerability where the bpf memory allocator fails to maintain a reference to the map BTF within the destructor record. When bpf_mem_alloc_destroy() defers a final drain to a workqueue, bpf_map_free() may free the map's BTF while the worker still holds a duplicate reco...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98812

A vulnerability exists in the Linux kernel 's net/mctp component where the mctp_add_dev() function incorrectly links a new mctp_dev into dev->mctp_ptr before the mdev->dev pointer is assigned. This race condition allows a reader to pick up the device in a window where it still points to NUL...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

EUVD-2026-103897

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

EUVD-2026-103896

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811

The Linux kernel contains a vulnerability in the net/sched: cls_api component where a race condition between two concurrent tc filter add requests on the same chain/priority of an unlocked classifier can cause an empty proto to remain linked in the chain. This occurs when both requests fail: the ...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98810

A slab-out-of-bounds read vulnerability exists in the Linux kernel within the wifi: mac80211 component. The issue occurs in ieee80211_monitor_select_queue() because the code validates packet length using skb->len, which includes non-linear fragments. When AF_PACKET sends a large enough packet ...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

EUVD-2026-103895

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...