CVE-2026-98836

A slab-out-of-bounds vulnerability exists in the Linux kernel ALSA line6 driver. The issue occurs in submit_audio_out_urb() because the number of bytes written into an out.buffer slice is not validated against the slice size. On devices with a large IN wMaxPacketSize and a small OUT wMaxPacketSiz...

EUVD-2026-103776

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

CVE-2026-98835 iio: accel: kionix-kx022a: Fix array boundary check

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

CVE-2026-98835 iio: accel: kionix-kx022a: Fix array boundary check

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

CVE-2026-98835

The Linux kernel contains a vulnerability in the iio: accel: kionix-kx022a driver. The driver fails to perform an accurate sanity check when converting a register value to an array index, incorrectly accepting sizeof(array) as a valid index instead of sizeof(array) - 1 . This constitutes an array...

EUVD-2026-103775

In the Linux kernel, the following vulnerability has been resolved: iio: accel: kionix-kx022a: Fix array boundary check The driver performs a sanity check for an array size, when converting a register value to an array index. The check incorrectly accepts the sizeofarray as a last index, when las...

EUVD-2026-103774

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

CVE-2026-98834

A vulnerability exists in the Linux kernel 's mtd core component related to the OTP NVMEM device . The issue is caused by a logic error where mtd_otp_nvmem_add() unregisters a user device during a factory OTP setup failure but fails to clear the mtd->otp_user_nvmem pointer. This leads to a dou...

CVE-2026-98834 mtd: core: avoid double-free of OTP NVMEM device

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

CVE-2026-98834 mtd: core: avoid double-free of OTP NVMEM device

In the Linux kernel, the following vulnerability has been resolved: mtd: core: avoid double-free of OTP NVMEM device If factory OTP setup fails after the user OTP NVMEM device has been registered, mtdotpnvmemadd unregisters the user device but leaves mtd-otpusernvmem set. On an error, the caller...

CVE-2026-98833 mtd: core: call _get_device() with the master MTD

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

EUVD-2026-103773

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

CVE-2026-98833

The Linux kernel contains a vulnerability in the mtd core where __get_mtd_device() incorrectly calls the master's _get_device() callback using the mtd (which may be a partition) instead of the master itself. This inconsistency breaks gluebi partitions because gluebi_get_device() requires the mast...

CVE-2026-98833 mtd: core: call _get_device() with the master MTD

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

CVE-2026-98832

The Linux kernel contains a vulnerability in the blk-cgroup subsystem where the function blkg_tryget_closest() uses spin_lock_irq() and spin_unlock_irq() to manage q->queue_lock. Because spin_unlock_irq() unconditionally enables local interrupts, it can cause a deadlock when called by function...

CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

EUVD-2026-103772

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

EUVD-2026-103771

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...