CVE-2026-98830 wifi: wfx: validate MIB read length before copying to caller

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98830

The Linux kernel contains a vulnerability in the wifi: wfx component. The function wfx_hif_read_mib() fails to validate that the reply->length from a firmware response does not exceed the val_len of the caller-provided buffer. This lack of bounds checking allows a firmware response with an ove...

EUVD-2026-103769

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829

The Linux kernel contains a vulnerability in the mac80211 component where oversized fragments can cause an extra_len overflow . The root cause is that entry->extra_len was narrowed from unsigned int to u16 to reduce memory footprint. When a sequence of large fragments exceeds 65535 bytes, the ...

EUVD-2026-103768

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98828 wifi: ath9k: reject short WMI command responses

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98828

The Linux kernel contains a vulnerability in the ath9k wifi driver within the ath9k_wmi_rsp_callback() function. The root cause is that the function copies the number of bytes expected by a waiting command into a response buffer without sufficiently verifying the length of the device response. If...

EUVD-2026-103767

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

CVE-2026-98827

The Linux kernel contains a vulnerability in the wifi: ath9k_htc driver where the __hif_usb_tx() function fails to check the cumulative byte length of aggregated frames. While the function limits the batch by record count (MAX_TX_AGGR_NUM), large frames with an MTU of 2304 can exceed the MAX_TX_B...

CVE-2026-98827 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

CVE-2026-98826 rtc: ac100: Fix clock provider use-after-free on probe failure

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100rtcregisterclks registers the RTC-32k clock with clkhwregisterfixedrate and the clock provider with ofclkaddhwprovider. Neither is device managed, and both are...

CVE-2026-98826

The Linux kernel contains a use-after-free vulnerability in the ac100 RTC driver. During a failed probe() operation, the driver fails to properly unregister the clock provider, leaving it on the global of_clk_providers list. Because the provider holds a pointer to chip->clk_data (which is free...

EUVD-2026-103766

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100rtcregisterclks registers the RTC-32k clock with clkhwregisterfixedrate and the clock provider with ofclkaddhwprovider. Neither is device managed, and both are...

CVE-2026-98825 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devmclkget error pointer in probe devmclkget&pdev-dev, "rtcref"'s return value was passed straight into clkgetrate without checking it for an error first, unlike the "rtc" clock a few lines above which is...

CVE-2026-98825

The Linux kernel contains a vulnerability in the rtc: mpfs driver where the return value of devm_clk_get() for the "rtcref" clock is not properly validated. Specifically, if the function returns an error pointer (such as ERR_PTR(-EPROBE_DEFER)), the code passes it directly to clk_get_rate(). Beca...

EUVD-2026-103765

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devmclkget error pointer in probe devmclkget&pdev-dev, "rtcref"'s return value was passed straight into clkgetrate without checking it for an error first, unlike the "rtc" clock a few lines above which is...

EUVD-2026-103764

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98824 wifi: mac80211: validate TX status rate metadata

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98824

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the minstrel_ht_tx_status() function fails to sufficiently validate HT/VHT rate metadata. Specifically, it did not verify if the reported MCS , spatial stream count , and bandwidth were representable by the minstrel_h...