CVE-2026-98937 perf/core: Check kernel access when kernel callchains are requested

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users can still request kernel callchain collection with...

CVE-2026-98937 perf/core: Check kernel access when kernel callchains are requested

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users can still request kernel callchain collection with...

CVE-2026-98936 wifi: ath11k: reset ar->num_stations on hardware start

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-98936 wifi: ath11k: reset ar->num_stations on hardware start

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

EUVD-2026-108908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-98936

The Linux kernel contains a vulnerability in the ath11k wireless driver where the num_stations variable in struct ath11k is not properly reset during multiple hardware restarts. This oversight in ath11k_mac_op_start() causes the driver to incorrectly believe the maximum station limit (128) is rea...

CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935

The Linux kernel is affected by an information leak vulnerability within the RTC (Real Time Clock) subsystem. Specifically, the struct rtc_wkalrm contains padding holes following the 'pending' member. When this structure is returned to userspace via the RTC_WKALRM_RD ioctl , uninitialized kernel ...

EUVD-2026-108907

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935 rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98934 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-98934 ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

EUVD-2026-108906

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-98934

The Linux kernel contains a vulnerability where the seg6_make_flowlabel() function could be reached with a socket buffer (skb ) lacking both skb->dev and skb->sk pointers. This issue occurs when a TIPC UDP bearer sends a discovery message via an IPv4 route using seg6 encap while net.ipv6.se...

CVE-2026-98933 usb: hub: use shorter 120ms post resume hold for SS root hubs

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

EUVD-2026-108905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-98933

The Linux kernel contains a vulnerability where holding a USB3 hub PM runtime reference for 200ms during hub resume triggers issues on AMD platforms . This specifically causes crashes for users running Android adb after the subsystem has been polled and woken periodically. The root cause is ident...

CVE-2026-98933 usb: hub: use shorter 120ms post resume hold for SS root hubs

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98932 EDAC/altera: Fix use-after-free in error paths

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...