CVE-2026-98594

A flaw was found in the Linux kernel's Broadcom Tigon3 tg3 ethernet driver. When the driver encounters an error during device initialization, it fails to properly release and unregister associated networking hardware resources. A local user capable of triggering initialization failures could...

CVE-2026-98593

A flaw was found in the Linux kernel's s390 debug subsystem. This vulnerability allows a local user to cause a Denial of Service DoS through a kernel crash. When static debug registration encounters an error, internal memory pointers are cleared while boundary records remain active. A local user...

CVE-2026-98592

A flaw was found in the Linux kernel's SpacemiT Ethernet driver. During network packet transmission, a failure to map packet fragments causes the driver to release memory buffers without properly clearing the corresponding hardware descriptors. A local user able to trigger transmission mapping...

CVE-2026-98591

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter subsystem. An integer underflow in the bounds-checking logic for network packet buffer pointers allows validation checks to pass incorrectly. A local user capable of running BPF programs could exploit this flaw to create pointers...

CVE-2026-98590

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. An error in context code generation incorrectly sign-extends register values when reading socket queue mappings, causing runtime register values to exceed boundaries tracked by the kernel's safety verifier. A local user...

CVE-2026-98589

A flaw was found in the Linux kernel's BPF Berkeley Packet Filter verifier. When packet pointers are passed into subprograms that mutate packet data, the verifier incorrectly assumes the underlying memory remains valid across calls, failing to account for operations that invalidate or relocate...

CVE-2026-98588

A flaw was found in the Linux kernel's Berkeley Packet Filter BPF subsystem. When allocating a socket map with an excessively large entry count, a signed integer overflow occurs during cleanup when the map is released. A local user with permission to create BPF maps can trigger this issue to caus...

CVE-2026-98587

A flaw was found in the Linux kernel's FireWire subsystem. A local user can trigger a race condition by concurrently releasing a device file descriptor while an asynchronous resource management task is running. This flaw allows a resource state to transition backwards from deallocation to...

CVE-2026-98584

A flaw was found in the Linux kernel's network traffic control subsystem. A local user can exploit this vulnerability to cause an information disclosure of kernel stack data. When dumping text search filter configurations, the kernel fails to initialize a stack structure before copying it into...

CVE-2026-98586

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP subsystem. This vulnerability can lead to a Denial of Service DoS through a kernel crash. A race condition occurs between timer rearming and cleanup operations because the system modifies a timer before properly...

CVE-2026-98585

A flaw was found in the Linux kernel's fbnic network driver. A local user with administrative privileges could trigger a denial of service DoS and crash the system by configuring a network ring buffer size of zero. Because the driver fails to validate the input before executing a rounding...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

kernel: perf: Fix addr_filter_ranges lifetime

A flaw was found in the Linux kernel's performance events perf subsystem. This vulnerability occurs because memory allocated for event address filters is released prematurely while still in active use by other kernel processes. A local user could exploit this use-after-free flaw during performanc...

CVE-2026-98583

A flaw was found in the Linux kernel's Marvell NFC Near Field Communication driver. During firmware download operations, the driver removes packet headers and reads command data before verifying that the received packet length is valid. An attacker could exploit this vulnerability by submitting a...

CVE-2026-98582

A flaw was found in the Linux kernel's ST21NFCA Near Field Communication NFC driver. The driver fails to properly validate the length of received frames when processing escape sequences. An attacker capable of sending crafted NFC frames could exploit this vulnerability to trigger an out-of-bounds...

CVE-2026-98581

A flaw was found in the Linux kernel's Near Field Communication NFC Logical Link Control Protocol LLCP implementation. When handling specific disconnection packets, the kernel fails to properly lock and unlink sockets before updating their state, leading to internal socket list corruption. A loca...

CVE-2026-98580

A flaw was found in the Linux kernel's Near Field Communication NFC Logical Link Control Protocol LLCP implementation. A race condition occurs during concurrent socket release and connection accept operations due to improper lock synchronization. A local attacker could exploit this flaw to cause ...

kernel: USB: serial: io_ti: fix heap overflow in get_manuf_info()

A flaw was found in the Linux kernel's ioti USB serial driver. A malicious USB device, when plugged into a host running this driver, can exploit a heap overflow vulnerability in the getmanufinfo function. This occurs because the driver does not properly validate the size of data read from the...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...