CVE-2026-98812

A vulnerability exists in the Linux kernel 's net/mctp component where the mctp_add_dev() function incorrectly links a new mctp_dev into dev->mctp_ptr before the mdev->dev pointer is assigned. This race condition allows a reader to pick up the device in a window where it still points to NUL...

CVE-2026-98811

The Linux kernel contains a vulnerability in the net/sched: cls_api component where a race condition between two concurrent tc filter add requests on the same chain/priority of an unlocked classifier can cause an empty proto to remain linked in the chain. This occurs when both requests fail: the ...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

EUVD-2026-103896

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

EUVD-2026-103895

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98810

A slab-out-of-bounds read vulnerability exists in the Linux kernel within the wifi: mac80211 component. The issue occurs in ieee80211_monitor_select_queue() because the code validates packet length using skb->len, which includes non-linear fragments. When AF_PACKET sends a large enough packet ...

CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

EUVD-2026-103894

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98808

The Linux kernel contains a buffer overflow vulnerability in the bcm_sysport_get_stats() function when running on SYSTEMPORT Lite . The issue occurs because the code incorrectly uses an iteration index (i) instead of a compacted index (j) to store values in a destination data buffer. Since the bu...

CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

EUVD-2026-103893

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98809

A vulnerability exists in the Linux kernel Bluetooth subsystem related to how the hci_sync component handles the cmd_sync backlog during unregistration. Specifically, the hci_unregister_dev() function calls hci_cmd_sync_clear() , which waits for hci_cmd_sync_work() to complete. Because the worker...

EUVD-2026-103892

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...