CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLKFEATZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespac...

EUVD-2026-103812

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLKFEATZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespac...

CVE-2026-98727

The Linux kernel contains a vulnerability in nvme-multipath where the namespace head is incorrectly marked as zoned at allocation time based solely on the command set identifier. If a zone info query returns a zero zone size, the path namespace is registered without zoned limits, but the head con...

CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

EUVD-2026-103811

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98726

The Linux kernel contains a vulnerability in nvme-multipath due to an underflow during ANA log bounds checks . The root cause involves subtracting an untrusted object size from ana_log_size before comparing it against the current offset; if the object size exceeds the buffer, the size_t subtracti...

CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

CVE-2026-98725

The Linux kernel contains an out-of-bounds write vulnerability in the nvmet_auth_challenge() function within the nvmet-auth component. The root cause is that the output buffer is received as a void pointer , causing sizeof(*d) to evaluate to one under GCC . This results in an undercount of the fi...

EUVD-2026-103810

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

EUVD-2026-103809

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

CVE-2026-98724

The Linux kernel contains a vulnerability in the nvmet driver related to pci-epf SGL segments. A host-controlled SGL segment length that is nonzero but smaller than a single SGL descriptor causes nr_descs to become zero. This leads the function nvmet_pci_epf_get_sgl_segment() to perform an out-of...

CVE-2026-98723 nvmet: copy the hostid into the ctrl before creating PR pc_refs

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pcrefs Commit 6202783184bf "nvmet: Improve nvmetallocctrl interface and implementation" added a second uuidcopy of args-hostid near the end of nvmetallocctrl, and commit...

EUVD-2026-103977

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pcrefs Commit 6202783184bf "nvmet: Improve nvmetallocctrl interface and implementation" added a second uuidcopy of args-hostid near the end of nvmetallocctrl, and commit...

CVE-2026-98723

The Linux kernel contains a vulnerability in the nvmet subsystem where the hostid is incorrectly copied into the controller. Due to a sequence error in the nvmet_alloc_ctrl() implementation, nvmet_ctrl_init_pr() snapshots a nil UUID into per-controller per-namespace reservation references because...

CVE-2026-98722 mtd: block2mtd: Fix divide error when erase_size is zero

In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erasesize is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice then evaluates if size % erasesize with a zero divisor, which triggers a...

EUVD-2026-103976

In the Linux kernel, the following vulnerability has been resolved: mtd: block2mtd: Fix divide error when erasesize is zero The erase size is parsed from the "block2mtd" module parameter and can be set to zero. adddevice then evaluates if size % erasesize with a zero divisor, which triggers a...

CVE-2026-98722

The Linux kernel contains a vulnerability in the mtd: block2mtd module where a divide error occurs if the erase_size module parameter is set to zero. The add_device() function performs a modulo operation (size % erase_size) without first validating that erase_size is non-zero, leading to a kernel...

CVE-2026-98721 mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending...

EUVD-2026-103975

In the Linux kernel, the following vulnerability has been resolved: mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ The Cadence NAND interrupt handler uses both the IRQ lock and completion object. Registering the IRQ before initializing them leaves a window in which a pending...