CVE-2026-98593

The Linux kernel contains a NULL pointer dereference vulnerability in the s390/debug component within the debug_info_copy() function. The issue occurs when debug_register_static() fails, as it clears areas, active_pages, and active_entries while leaving the area bounds unchanged. This causes debu...

CVE-2026-98592

The Linux kernel contains a vulnerability in the spacemit driver. The emac_tx_mem_map() function prematurely writes TX_DESC_0_OWN into ring descriptors before all fragments are successfully mapped. If emac_tx_map_frag() fails, the error path calls emac_free_tx_buf() to unmap buffers but fails to ...

CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

EUVD-2026-103637

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98591

The Linux kernel contains a vulnerability in the skb_pointer_if_linear() function used by skb-backed BPF dynptr code. The root cause is an unsigned subtraction underflow occurring between skb_headlen and the off parameter. This flaw allows the bounds check to spuriously pass, potentially generati...

CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

EUVD-2026-103636

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98590

The Linux kernel contains a vulnerability in the bpf_sock context code generation. The issue arises because the ctx access code reads the rx_queue_mapping field using a 4-byte or 2-byte load, but the emitted code uses BPF_MOV_IMM64 for certain special values (like -1). This causes sign-extension,...

CVE-2026-98590 bpf: Fix bpf_sock context code generation

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

CVE-2026-98590 bpf: Fix bpf_sock context code generation

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

EUVD-2026-103635

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

CVE-2026-98589 bpf: Reject pkt arguments in mutating subprogs

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid...

EUVD-2026-103634

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid...

CVE-2026-98589 bpf: Reject pkt arguments in mutating subprogs

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject pkt arguments in mutating subprogs The verifier tracks changes in how PTRTOPACKET registers' bounds are modified across subprog boundaries. PTRTOPACKET registers are actually passed as PTRTOMEM, which is assumed valid...

CVE-2026-98589

The Linux kernel contains a vulnerability where the BPF verifier incorrectly handles PTR_TO_PACKET registers across subprogram boundaries. Because these registers are passed as PTR_TO_MEM , the verifier assumes the memory remains valid for the entire call; however, a pskb_ * call can invalidate t...

CVE-2026-98588

The Linux kernel is vulnerable to an out-of-bounds write in the sockmap component. The root cause is that sock_map_alloc() fails to reject max_entries values greater than INT_MAX, while sock_map_free() uses a signed integer iterator to traverse the sks[] array. When a SOCKMAP is created with max_...

CVE-2026-98588 bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

CVE-2026-98587 firewire: cdev: fix back-transition for iso_resource_auto client resource

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for isoresourceauto client resource The todo member of isoresourceauto structure represents the state of the client resource and normally transitions in the following order: ISORESAUTOALLOC -...