CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

EUVD-2026-103901

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

CVE-2026-98816

The Linux kernel contains a vulnerability where an overflow of the jump offset occurs during constant blinding in the bpf subsystem. Specifically, the bpf_jit_blind_insn() function rewrites instructions and subtracts 2 from the jump offset off. Because off is a 16-bit signed integer, values such ...

CVE-2026-98815 nvme: fix cdev lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98815

The Linux kernel contains a vulnerability in the NVMe driver related to cdev lifetime management. In multipath mode , when tearing down the NS head , the system calls nvme_cdev_del() followed by cdev_device_del() and cdev_del(). However, open cdevs remain accessible, allowing the kernel to refere...

CVE-2026-98815 nvme: fix cdev lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

EUVD-2026-103900

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98814

The Linux kernel contains a use-after-free vulnerability within the nvme_core component. The issue occurs when an I/O passthrough command is sent through a multipath namespace head after the controller path that initially created the head has been removed. KASAN identified the bug as a slab-use-a...

CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

EUVD-2026-103899

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

EUVD-2026-103898

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813

The Linux kernel contains a vulnerability where the bpf memory allocator fails to maintain a reference to the map BTF within the destructor record. When bpf_mem_alloc_destroy() defers a final drain to a workqueue, bpf_map_free() may free the map's BTF while the worker still holds a duplicate reco...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

EUVD-2026-103897

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...