CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

EUVD-2026-103780

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

CVE-2026-98840 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

CVE-2026-98840

The Linux kernel is vulnerable to a Use-After-Free (UAF) condition within the vcs_write() function. The root cause is that the reload of the vc pointer occurs after an if (ret) block; consequently, a copy-failure break path can exit the loop without reloading the pointer. If the vc structure is f...

CVE-2026-98840 vc_screen: reload vc pointer before if (ret) in vcs_write() to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: vcscreen: reload vc pointer before if ret in vcswrite to avoid UAF The reload of 'vc' added by commit 8fb9ea65c9d1 "vcscreen: reload load of struct vcdata pointer in vcswrite to avoid UAF" sits after the 'if ret' block, so the...

CVE-2026-98839

The Linux kernel contains a vulnerability in the paste_selection() function where a race condition can lead to a slab-out-of-bounds read . Because the selection mutex (vc_sel.lock) is released inside the loop, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace the selection buffer with a sho...

CVE-2026-98839 vt: selection: Fix unsigned underflow and slab-out-of-bounds read in paste_selection()

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

EUVD-2026-103779

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

EUVD-2026-103778

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...

CVE-2026-98838 vt: skip screen update for DEC alignment test on backgroup consoles

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...

CVE-2026-98838

The Linux kernel contains a slab-out-of-bounds vulnerability in the vt subsystem. The issue arises because the do_con_trol path (triggered by the ESC # 8 command) omits the con_should_update() check required by do_update_region(). When a user changes the font size of an invisible virtual console,...

CVE-2026-98838 vt: skip screen update for DEC alignment test on backgroup consoles

In the Linux kernel, the following vulnerability has been resolved: vt: skip screen update for DEC alignment test on backgroup consoles BUG Recently, we encountered a KASAN warning as follows: BUG: KASAN: slab-out-of-bounds in fbpadalignedbuffer+0x11f/0x140 Read of size 1 at addr ff1100015fd9f6a4...

CVE-2026-98837 ALSA: caiaq: unregister the input device when probe fails

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...

CVE-2026-98837

The Linux kernel contains a slab-use-after-free vulnerability in the ALSA driver (caiaq ). When setup_card() registers an input device but subsequent initialization functions like snd_card_register() or snd_usb_caiaq_control_init() fail, the snd_probe() function calls snd_card_free(). This frees ...

EUVD-2026-103777

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...

CVE-2026-98837 ALSA: caiaq: unregister the input device when probe fails

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: unregister the input device when probe fails setupcard registers the input device, whose name and phys point into struct sndusbcaiaqdev, and then goes on to sndcardregister and sndusbcaiaqcontrolinit. If either fails...

CVE-2026-98836

A slab-out-of-bounds vulnerability exists in the Linux kernel ALSA line6 driver. The issue occurs in submit_audio_out_urb() because the number of bytes written into an out.buffer slice is not validated against the slice size. On devices with a large IN wMaxPacketSize and a small OUT wMaxPacketSiz...

CVE-2026-98836 ALSA: line6: reject oversized playback packets

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

EUVD-2026-103776

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...

CVE-2026-98836 ALSA: line6: reject oversized playback packets

In the Linux kernel, the following vulnerability has been resolved: ALSA: line6: reject oversized playback packets Each playback URB is handed a slice of out.buffer that is exactly LINE6ISOPACKETS maxpacketsizeout bytes, sized from the OUT endpoint, but the number of bytes written into that slice...