CVE-2026-98329

The Linux kernel contains a vulnerability in the mac80211 component where frames injected on a monitor interface can include a radiotap field requesting a bandwidth wider than the actual operational bandwidth. The system currently passes these requests to the driver, which can trigger a WARN_ON i...

CVE-2026-98328 wifi: mac80211: add HE 6 GHz capability in the scan elems len

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98329 wifi: mac80211: don't allow injecting frames wider than the chanctx

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual...

CVE-2026-98327 wifi: mac80211: mesh: reset the CSA state when leaving

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

CVE-2026-98327

A vulnerability exists in the Linux kernel within the wifi: mac80211: mesh component. The issue occurs because ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() but is only freed in ieee80211_mesh_finish_csa() upon completion of a channel switch. If a user leaves the mesh while a switch i...

EUVD-2026-93312

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

CVE-2026-98326 wifi: mac80211: mesh: release the channel if start fails

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

EUVD-2026-93311

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

CVE-2026-98326

The Linux kernel contains a vulnerability in the wifi: mac80211: mesh component where the ieee80211_join_mesh() function acquires a channel context but fails to release it if the subsequent ieee80211_start_mesh() call fails. This improper handling leads to a warning during interface removal becau...

CVE-2026-98325

The Linux kernel contains a vulnerability in the wifi: mac80211 component where failed socket buffer (SKB) structures were not properly reported to userspace during certain failure paths. The issue stems from the timing of TX information setup; specifically, the skb->cb[] array was not initial...

EUVD-2026-93310

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

EUVD-2026-93309

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98323

The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...

CVE-2026-98324

The Linux kernel contains a vulnerability within the dmaengine: pxa component caused by double counting of hardware descriptors . Specifically, when pxad_alloc_desc() was converted to use kzalloc_flex(), it began setting the sw_desc->nb_desc counter automatically in newer compilers (GCC 15.1+ ...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

EUVD-2026-93308

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...