CVE-2026-98545

A flaw was found in the Linux kernel's libata SCSI subsystem. When processing ATA pass-through commands to an ATAPI storage device, the kernel fails to properly validate the length byte returned in the device's sense response buffer. A malicious or faulty device can exploit this issue to trigger...

CVE-2026-98541

A flaw was found in the Linux kernel's Foo-over-UDP FOU networking subsystem. When configuring a direct encapsulation tunnel without specifying the required network protocol attribute, the kernel permits tunnel socket creation with an uninitialized protocol value. Consequently, incoming network...

CVE-2026-98544

A flaw was found in the Linux kernel's Brocade 10Gb Ethernet bna driver. During device removal or shutdown, internal timers can rearm each other and continue executing after associated driver data structures have been released. A local user with administrative privileges could exploit this race...

CVE-2026-98543

A flaw was found in the Linux kernel. A local privileged user could cause a Denial of Service DoS or file system corruption due to improper locking in the BPF Berkeley Packet Filter subsystem. When attaching sleepable BPF programs to certain file removal hooks, the kernel verifier incorrectly...

CVE-2026-98539

A flaw was found in the Linux kernel's NTFS3 file system driver. A race condition during directory creation allows concurrent path lookup or mount operations to access and lock an inode before its initialization finishes. This improper synchronization resets and corrupts the directory's internal...

CVE-2026-98540

A flaw was found in the Linux kernel's function probe fprobe tracing component. This vulnerability can result in a Denial of Service DoS due to improper memory initialization. When tracing kernel functions, unused shadow stack space is left uncleared, causing return routines to parse leftover dat...

CVE-2026-98538

A flaw was found in the Linux kernel's writeback subsystem. This flaw allows a local user to cause a Denial of Service DoS by triggering prolonged processor stalls. When the kernel cleans up offline control group writeback structures with a large number of cached files, it repeatedly rescans...

kernel: tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done

A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication TIPC cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before ...

kernel: openvswitch: defer tunnel netdev_put to RCU release

A flaw was found in the Linux kernel's Open vSwitch OVS component. A race condition can occur during the destruction of a network device netdev tunnel, where the ovsnetdevtunneldestroy function may attempt to release a device reference while other parts of the system are still actively using it...

kernel: sctp: validate stream count in sctp_process_strreset_inreq()

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. When processing a Stream Reset Incoming Request RESETINREQUEST from a peer, the kernel does not properly validate the stream count. This can lead to an integer overflow when calculating the size for t...

kernel: sctp: fix race between sctp_wait_for_connect and peeloff

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

kernel: xfrm: Check for underflow in xfrm_state_mtu

A flaw was found in the Linux kernel's xfrm IPSec framework component. A local, unprivileged user can trigger an integer underflow in the Encapsulating Security Payload ESP module's Maximum Transmission Unit MTU calculation. This underflow leads to a severe out-of-bounds write, which can cause...

kernel: exec: Cleanup POSIX timers right after de_thread()

A flaw was found in the Linux kernel. When a multi-threaded program sets up a per-thread timer and executes a new program that subsequently fails during startup, the kernel can free timer memory while it remains referenced in an active queue. A local user could exploit this vulnerability to trigg...

kernel: smb: client: fix OOB read/write from unvalidated DataOffset in coalesce_t2()

A flaw was found in the Linux kernel's Server Message Block SMB client. The coalescet2 function processes server-supplied DataOffset fields without proper validation against buffer boundaries. A remote attacker could exploit this by crafting malicious SMB responses. This could lead to out-of-boun...

kernel: usb: typec: tcpm: bound altmode_desc[] per iteration in svdm_consume_modes()

A flaw was found in the Linux kernel's USB Type-C Port Manager TCPM driver. A remote attacker, acting as a malicious USB-C port partner, could exploit an out-of-bounds write vulnerability in the svdmconsumemodes function. By sending an unsolicited 'Discover Modes ACK' with excessive data, the...

kernel: signal: Prevent exec() race

A flaw was found in the Linux kernel's signal handling subsystem. A race condition occurs during process execution when managing pending timer signals, allowing the system to reference memory after it has been released. A local attacker could exploit this use-after-free flaw to achieve privilege...

kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CVE-2026-98535

A flaw was found in the Linux kernel's Freescale Frame Manager fman network driver. During device initialization, the driver retrieves a system clock resource to check its frequency but fails to release the reference count after reading the value. This omission results in a resource leak,...

CVE-2026-98537

A flaw was found in the Linux kernel's workqueue subsystem. A local attacker can cause a Denial of Service DoS by inducing memory pressure that triggers an out-of-memory notification. During subsequent dependency checks, a worker thread not actively running a task dereferences a null pointer,...

CVE-2026-98536

A flaw was found in the Linux kernel's writeback subsystem. This vulnerability can lead to a Denial of Service DoS when the routine responsible for cleaning up offline control group writeback structures fails to report a quiescent state during extended cleanup passes under certain preemption...