kernel: smb: client: reject a tree connect response whose byte count is too small

A flaw was found in the Linux kernel's Server Message Block SMB client. A remote malicious SMB server could send a specially crafted tree connect response with a byte count that is too small. This incorrect handling can lead to an integer underflow, causing the client to read beyond an allocated...

CVE-2026-98535

A flaw was found in the Linux kernel's Freescale Frame Manager fman network driver. During device initialization, the driver retrieves a system clock resource to check its frequency but fails to release the reference count after reading the value. This omission results in a resource leak,...

CVE-2026-98537

A flaw was found in the Linux kernel's workqueue subsystem. A local attacker can cause a Denial of Service DoS by inducing memory pressure that triggers an out-of-memory notification. During subsequent dependency checks, a worker thread not actively running a task dereferences a null pointer,...

CVE-2026-98536

A flaw was found in the Linux kernel's writeback subsystem. This vulnerability can lead to a Denial of Service DoS when the routine responsible for cleaning up offline control group writeback structures fails to report a quiescent state during extended cleanup passes under certain preemption...

CVE-2026-98468

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64. This flaw may allow a local user to cause a Denial of Service DoS or kernel instability. A race condition occurs when virtual machine stage 2 memory tables are freed concurrently with host memory migratio...

CVE-2026-98533

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. When dm-verity updates a root hash, the old hash can be freed while concurrent policy evaluation operations are still accessing it. A local attacker could exploit this use-after-free condition to trigger a Denial o...

CVE-2026-98534

A flaw was found in the Linux kernel's Integrity Policy Enforcement IPE subsystem. A local attacker can cause a denial of service DoS or potentially execute arbitrary code by triggering a race condition during policy management. This issue occurs when a newly loaded policy is audited after intern...

CVE-2026-98467

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem for ARM64 architecture. A race condition during the teardown of nested virtual machine memory mappings can cause the kernel to dereference a null pointer. A local user or nested guest can trigger concurrent memory...

CVE-2026-98532

A flaw was found in the Linux kernel. A remote attacker could cause a Denial of Service DoS or memory corruption by sending specially crafted IPv6 network packets. The IPv6 extension header parsing mechanism fails to verify that the declared length of a header fits within the received packet data...

CVE-2026-98531

A flaw was found in the Linux kernel's IPv6 Segment Routing SRv6 component. This flaw allows a local user to cause an information disclosure. By sending a crafted Generic Netlink message with an attribute shorter than expected, the system performs an out-of-bounds read into uninitialized kernel...

CVE-2026-98465

A flaw was found in the Linux kernel's Kernel-based Virtual Machine KVM subsystem for the RISC-V architecture. Due to missing synchronization between interrupt controller device operations and virtual CPU vCPU execution, a local user with access to the KVM interface can trigger a race condition...

CVE-2026-98466

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine subsystem on ARM64 platforms. During system initialization in protected virtualization modes, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages. A privileged local host c...

CVE-2026-98530

A flaw was found in the Linux kernel's kprobes subsystem. A privileged local user could trigger improper synchronization when disabling or flushing probe optimization, causing the process to hang indefinitely while holding an internal lock. This issue can make administrative interfaces...

CVE-2026-98464

A flaw was found in the Linux kernel's KVM Kernel-based Virtual Machine implementation for the RISC-V architecture. This vulnerability can lead to a Denial of Service DoS or host system crash due to a use-after-free memory issue during virtual machine teardown. A race condition allows a timer...

CVE-2026-98528

A flaw was found in the Linux kernel's GPIO General Purpose Input/Output character device interface. This vulnerability allows a local user to cause an information disclosure of sensitive kernel stack data. When an error occurs while querying GPIO line details, the kernel fails to clear the data...

CVE-2026-98458

A flaw was found in the Linux kernel's Bluetooth subsystem. A local attacker can cause a Denial of Service DoS through a reference count leak during Bluetooth Isochronous ISO channel attachment. When a socket attempts to attach to a channel that is already connected or in use by another socket, t...

CVE-2026-98529

A flaw was found in the Linux kernel's Arizona General Purpose Input/Output GPIO driver. This issue allows a local user to cause a resource leak by triggering an error during persistent GPIO line configuration. Specifically, if an internal register update fails while changing pin direction from...

CVE-2026-98527

A flaw was found in the Linux kernel's Zynq General Purpose Input/Output GPIO driver. A local user could cause a Denial of Service DoS when requesting a GPIO line fails due to improper reference count handling in the runtime power management subsystem. The error path fails to decrement the usage...

CVE-2026-98516

A flaw was found in the Linux kernel's Nouveau graphics driver. The driver fails to properly release a reference to a PCI Peripheral Component Interconnect bridge device after querying its configuration space during initialization. A local user could exploit this flaw during device setup or bindi...

CVE-2026-98451

A flaw was found in the Linux kernel's SMB client. A local user can trigger this issue by opening an existing symbolic link or non-regular file on an SMB mount using file creation flags. Because the client improperly handles non-regular files during open operations, it fails to release directory...