CVE-2026-98902

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98913

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvfprobe caviumptpget acquires a reference to the PTP PCI device through pcigetdevice. If any initialization step fails after caviumptpget, the PTP PCI device reference is leaked. Add a...

CVE-2026-98877

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgicv4enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gicdomain” is NULL and the...

CVE-2026-98897

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci-mlock while waiting for a lease break ack When a cifs.ko client caches a read-handle RH lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in...

CVE-2026-98907

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

CVE-2026-98891

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211rxmgmtdeauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length...

CVE-2026-98906

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

CVE-2026-98899

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98871

In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Fix possible deadlock in SEV init failure path sevplatforminithandleinitexpath calls rmpmarkpagesfirmware with locked=false while the parent function of initexpath already acquired the sevcmdmutex. In the case of an...

CVE-2026-98895

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98890

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbshardstartxmit casts skb-data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The...

CVE-2026-98875

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/gsp: add SEC2 to GA100 chip table The booter-load and booter-unload firmware run on the SEC2 falcon. During tu102gsponeinit, the booter constructor needs device-sec2 to access the SEC2 falcon. Without the .sec2 entry,...

CVE-2026-98886

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98885

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

CVE-2026-98915

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2videounregisterdevice on driver removal The driver uses vb2foprelease as its file release operation, so vb2videounregisterdevice should be used instead of videounregisterdevice during driver removal. This...

CVE-2026-98904

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pmruntimeenable into the removal path instead doing it early. This ensure...

CVE-2026-98880

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle setblocksize failures ntfs3 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98892

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98876

In the Linux kernel, the following vulnerability has been resolved: host1x: bus: Fix missing ops null check in error teardown In host1xdeviceinit, the error teardown paths do not check client-ops before dereferencing it, unlike the forward init paths which correctly guard with 'client-ops &&'. Th...