CVE-2026-98961

The Linux kernel contains a vulnerability in the btrfs filesystem related to how locks are handled during io_uring operations. Specifically, in the btrfs_uring_read_extent() function, the system takes an inode shared lock and an extent lock . Previously, a pages-array allocation failure would ret...

CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

EUVD-2026-108754

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98960

The Linux kernel 's btrfs filesystem contains a vulnerability where btrfs_uring_encoded_data is leaked if the request is cancelled or the ring exits before reissue. This occurs because the kernel returns -EAGAIN while leaving the encoded data in the command PDU, and io_uring does not free driver ...

CVE-2026-98959

The Linux kernel contains a vulnerability in the btrfs filesystem where replacing an extended attribute (xattr) value with a different size can cause filesystem corruption. When multiple xattrs are packed into the same btrfs_dir_item (due to matching crc32c hashes), using the setxattr(2) syscall ...

EUVD-2026-108753

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfsdiritem item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

CVE-2026-98959 btrfs: fix xattr replace when multiple xattrs are packed in the same item

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfsdiritem item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

EUVD-2026-108932

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

CVE-2026-98958 wifi: mt76: account non-AQL frames per peer rather than per link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

CVE-2026-98958 wifi: mt76: account non-AQL frames per peer rather than per link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

CVE-2026-98958

The Linux kernel contains a vulnerability in the wifi: mt76 driver. The driver incorrectly accounts for non-AQL frames by incrementing a counter when a frame enters the hardware queue and decrementing it upon completion. For MLO peers , the hardware may report completion on a different link than ...

CVE-2026-98957 wifi: mt76: mt7915: disable rx napi when removing device

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

EUVD-2026-108931

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

CVE-2026-98957 wifi: mt76: mt7915: disable rx napi when removing device

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

CVE-2026-98957

The Linux kernel contains a vulnerability in the mt76 driver for the mt7915 chipset. When unloading the mt7915e module on an MT7916 device, the driver fails to disable the napi before destruction, triggering multiple warnings in __netif_napi_del_locked() and page_pool_disable_direct_recycling(). ...

CVE-2026-98956

The Linux kernel contains a vulnerability in the ASoC: adau1372 driver related to how it handles powerdown GPIOs. Specifically, the driver previously called gpiod_set_value(), which triggered a WARN message when interacting with GPIO providers that indicate they can sleep (common in I2C controlle...

CVE-2026-98956 ASoC: adau1372: allow sleepy powerdown GPIOs

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...

CVE-2026-98956 ASoC: adau1372: allow sleepy powerdown GPIOs

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...

EUVD-2026-108930

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...