CVE-2026-98597

In the Linux kernel, the following vulnerability has been resolved: net: usb: sr9700: include receive overhead in the length check The receive fixup subtracts the Ethernet CRC from the reported packet length, but compares that payload length against the whole remaining receive buffer. The followi...

CVE-2026-98605

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98580

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix race condition in acceptqueue lifecycle In nfcllcpsocketrelease, sockets and listener accept queues are walked under the local sockets rwlock and bhlocksock. However, bhlocksock does not synchronise against...

CVE-2026-98591

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98565

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98819

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98767

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3checkeventbuf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed even...

CVE-2026-98758

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98449

In the Linux kernel, the following vulnerability has been resolved: smb: client: delete compound mids on send failure before unlock When sending a compound request fails, smbsendrqst kicks off a reconnect. compoundsendrecv still has those mids on pendingmidq, but it unlocks the server without...

CVE-2026-98626

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98640

In the Linux kernel, the following vulnerability has been resolved: HID: amdsfh: Validate PCI BAR size before mapping The amdsfh driver maps PCI BAR 2 using pcimiomapregions and subsequently accesses MMIO registers at offsets up to 0x10958 e.g., AMDP2CMSG3 at 0x1068C. However, the driver never...

CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

CVE-2026-98583

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98534

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

CVE-2026-98868

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: reject a kset that overruns its segment cachereplay, the writeback worker and the GC worker read a kset of getksetonmediasize bytes and advance the position by it. A forged keynum makes that size exceed the segment's...

CVE-2026-98858

In the Linux kernel, the following vulnerability has been resolved: iouring: fix taskwork add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush has published it. I...

CVE-2026-98792

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98793

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98865

In the Linux kernel, the following vulnerability has been resolved: schedext: Don't run ops.dequeue with a DSQ lock held ops.dequeue is invoked with the source user DSQ's lock still held on the consume and move paths scxconsumedispatchq, movetaskbetweendsqs. A BPF scheduler which locks the source...