CVE-2026-98894

In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does...

CVE-2026-98915

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2videounregisterdevice on driver removal The driver uses vb2foprelease as its file release operation, so vb2videounregisterdevice should be used instead of videounregisterdevice during driver removal. This...

CVE-2026-98899

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98900

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98902

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

CVE-2026-98913

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvfprobe caviumptpget acquires a reference to the PTP PCI device through pcigetdevice. If any initialization step fails after caviumptpget, the PTP PCI device reference is leaked. Add a...

CVE-2026-98907

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

CVE-2026-98903

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

CVE-2026-98901

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

CVE-2026-98905

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...

CVE-2026-98904

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pmruntimeenable into the removal path instead doing it early. This ensure...

CVE-2026-98908

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources...

CVE-2026-98886

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

CVE-2026-98911

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...

CVE-2026-98874

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: don't WARN on WoWLAN suspend w/o netdetect Clearly, from a user perspective, it must be valid to configure WoWLAN and then suspend while not connected to a network. Since mac80211 doesn't distinguish these cas...

CVE-2026-98880

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle setblocksize failures ntfs3 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98878

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI system instruction. Onc...

CVE-2026-98883

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...

CVE-2026-98884

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...