EUVD-2026-103622

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98577

The Linux kernel contains a vulnerability in the nfc_llcp_wks_sap() function, which allows for WKS SAP hijacking . The root cause is that the function compares only service_name_len bytes, leading to a prefix match where a short service name (e.g., "u") incorrectly matches longer WKS strings (e.g...

CVE-2026-98577 nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix WKS SAP hijacking via prefix match in nfcllcpwkssap nfcllcpwkssap compares only servicenamelen bytes, so a short servicename like "u" matches longer WKS strings like "urn:nfc:sn:snep". Fix by requiring exact length...

CVE-2026-98576

The Linux kernel contains a vulnerability in the nfc: llcp component where the functions nfc_llcp_wks_sap() and nfc_llcp_build_sdreq_tlv() pass non-null-terminated strings to pr_debug() using the %s format specifier. Because these buffers are allocated via kmemdup() or sourced from netlink attrib...

EUVD-2026-103621

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98576 nfc: llcp: fix slab-out-of-bounds reads when logging service names

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

EUVD-2026-103620

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

CVE-2026-98575

The Linux kernel nfc driver for pn533 is vulnerable to an Out-of-Bounds (OOB) read in the pn533_acr122_is_rx_frame_valid() function. The root cause is that frame->ccid.datalen is read directly from a USB response frame and used as an unchecked index into the frame->data[] array. A malicious...

CVE-2026-98575 nfc: pn533: fix OOB read in pn533_acr122_is_rx_frame_valid()

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: fix OOB read in pn533acr122isrxframevalid frame-ccid.datalen is read directly from the USB response frame and used, unchecked, as an index into frame-data. A malicious or malfunctioning device can set this field to an...

EUVD-2026-103619

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop and the Wake-on-LAN branch of bcmgenetsuspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls...

CVE-2026-98574

The Linux kernel contains a vulnerability in the bcmgenet driver related to how it handles transmit (Tx) queues during shutdown or suspension. Specifically, in bcmgenet_netif_stop() and the Wake-on-LAN branch of bcmgenet_suspend(), the driver disables the Tx queues before stopping the Tx NAPI . T...

CVE-2026-98574 net: bcmgenet: stop Tx NAPI before disabling the queues

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: stop Tx NAPI before disabling the queues bcmgenetnetifstop and the Wake-on-LAN branch of bcmgenetsuspend both disable the Tx queues first and stop Tx NAPI several steps later. A completion in flight calls...

EUVD-2026-103618

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

EUVD-2026-103617

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was...

CVE-2026-98572

The Linux kernel contains a vulnerability in the bpf subsystem related to MIPS32 architecture. Specifically, the system incorrectly emitted an addu instruction instead of an addiu instruction for immediate JMP JEQ/JNE operations. This caused the immediate value of 1 to be misinterpreted as regist...

CVE-2026-98573

The Linux kernel is vulnerable to an underflow in skb_checksum_setup_ipv6() within the net: skbuff component. The skb_maybe_pull_tail() function fails to ensure that the max argument is at least skb_headlen(skb), leading to a wrap-around to a negative delta when parsing IPv6 extension headers on ...

CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

CVE-2026-98572 bpf: Fix immediate JMP JEQ/JNE on MIPS32

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix immediate JMP JEQ/JNE on MIPS32 An addu instruction was emitted instead of addiu, causing the immediate value 1 to be interpreted as register $at. This made the comparison result invalid when the immediate operand was...

EUVD-2026-103616

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmacrx, when napibuildskb fails the descriptor page is recycled back to the page pool with pagepoolrecycledirect, but buf-page is left pointing at the...

CVE-2026-98571

The Linux kernel contains a vulnerability in the stmmac driver where buf->page is not cleared after a page is recycled via page_pool_recycle_direct() during a napi_build_skb() failure. This stale pointer causes stmmac_rx_refill() to skip replacement allocation and incorrectly program the alrea...