CVE-2026-98846

The Linux kernel contains a vulnerability in the sctp implementation where sctp_wait_for_connect() drops the socket lock while sleeping. This allows an out-of-the-blue ABORT to unlink the association. If a concurrent shutdown(fd, SHUT_RD) sets RCV_SHUTDOWN, the waiter can break with err == 0 and ...

CVE-2026-98845

The Linux kernel contains a vulnerability where the TPM (Trusted Platform Module) fails to disable the chip upon a null key name mismatch . This check is designed to protect against TPM reset attacks ; however, because the tpm2_load_null() function returns success (0) even when a mismatch occurs,...

CVE-2026-98845 tpm: Disable TPM on null key name mismatch

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

EUVD-2026-103785

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-98845 tpm: Disable TPM on null key name mismatch

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

EUVD-2026-103784

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98844

The Linux kernel contains a vulnerability in the netfs component where the pagecache is not properly cleared when a file is extended via a write operation. Specifically, dirty data left by writes through an mmapped region in a hole created after the End-of-File (EOF) could persist. The fix involv...

EUVD-2026-103783

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98843 netfs: zero gaps in read-gaps folio to avoid writing back stale data

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98843

The Linux kernel contains a vulnerability in the netfs component where the netfs_read_gaps() function left gaps around a streaming write's dirty region unread on the server side. This issue could cause stale folio content to be written back if a short or EOF response occurred. The fix involves ze...

CVE-2026-98843 netfs: zero gaps in read-gaps folio to avoid writing back stale data

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98842

The Linux kernel contains a vulnerability where the codetag_load_module() function fails to set the error code upon failure. Consequently, load_module() incorrectly returns 0 after the module has been torn down. Additionally, if the module is a livepatch , the mod->klp_info allocated by copy_m...

CVE-2026-98842 module: fix lost error code from codetag_load_module()

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

EUVD-2026-103782

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98842 module: fix lost error code from codetag_load_module()

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

EUVD-2026-103781

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...