CVE-2026-98951 riscv: ptrace: Zero-initialize regset buffers before copyin

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

EUVD-2026-108925

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

CVE-2026-98951

The Linux kernel contains a vulnerability in the riscv architecture's ptrace implementation. The user_regset_copyin() function only copies a specific number of bytes, which can leave a portion of the stack buffer uninitialized when a PTRACE_SETREGSET request is made with a short iov_len. This uni...

EUVD-2026-108924

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98950 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98950 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98950

The Linux kernel contains a vulnerability in the bpf_flow_dissect() function where the hlen (header length) parameter can undergo u16 truncation during offset sanitization. When hlen exceeds 65535, the upper bound is truncated before being used in clamp_t(u16, ..., hlen) . For example, if hlen is...

EUVD-2026-108922

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

CVE-2026-98948

The Linux kernel contains a resource leak vulnerability in the mlxsw: spectrum_flower driver. The function mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct to compute rulei.values.elusage. During this process, the mlxsw_sp_flower_parse_ports_range() func...

CVE-2026-98948 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

CVE-2026-98949 drm/imagination: Fix reference and vm_bo handling in remap()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98949 drm/imagination: Fix reference and vm_bo handling in remap()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

EUVD-2026-108923

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98949

The Linux kernel contains a vulnerability in the drm/imagination driver within the pvr_vm_gpuva_remap() function. When a map overlaps an existing mapping, the function incorrectly splits the mapping and fails to handle references and vm_bo links correctly. Specifically, it leaks one GEM reference...

CVE-2026-98948 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

EUVD-2026-108921

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947

The Linux kernel contains a memory leak vulnerability within the vmci_transport_recv_dgram_cb() function. During the closure of a datagram socket , this function may add packets to the socket's backlog. Subsequently, the __release_sock() function moves these packets from the backlog back to the r...

CVE-2026-98946

The Linux kernel contains a vulnerability in the drm/vc4 driver where the V3D interrupt is not properly quiesced during runtime suspend. On RPi 0-3 , the use of the ARMCTRL interrupt controller allows a CPU to acknowledge an interrupt without it becoming visible to synchronize_irq(). This can cau...