CVE-2026-98601

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98444

In the Linux kernel, the following vulnerability has been resolved: xfs: drop dquot flush lock when we can't find a buffer to flush LOLLM noticed that xfsqmflushone fails to drop the dquot flush lock if it can't grab the buffer associated with the dquot. Since there's no buffer, nobody else is...

CVE-2026-98476

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

CVE-2026-98852

In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b "net: correctly handle tunneled traffic on IPV6CSUM GSO fallback" split skbgsohasextensionhdr into mutually exclusive branches on skb-encapsulation. This d...

CVE-2026-98862

In the Linux kernel, the following vulnerability has been resolved: audit: fix exe mark UAF in killrules killrules removes mixed AUDITDIR and AUDITEXE rules when an audit tree is pruned. It drops entry-rule.exe before removing the rule from the RCU-visible filter lists. After a rule has been...

CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

CVE-2026-98851

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: drop flowtable reference on init error path nftflowoffloadinit bumps the flowtable use count with nftuseinc before calling nfctnetnsget. When the latter fails, the error is returned as-is and the...

CVE-2026-98845

In the Linux kernel, the following vulnerability has been resolved: tpm: Disable TPM on null key name mismatch The null key name check exists to protect against TPM reset attacks, so a mismatch should stop the device from serving further requests. Currently it does not disable the chip when it...

CVE-2026-98858

In the Linux kernel, the following vulnerability has been resolved: iouring: fix taskwork add use-after-free with SQPOLL For SQPOLL, the sqpoll thread runs taskwork off its own list and doesn't need to be told about it, so it can pop and complete a request as soon as mpscqpush has published it. I...

CVE-2026-98793

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98603

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

CVE-2026-98599

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

CVE-2026-98576

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix slab-out-of-bounds reads when logging service names nfcllcpwkssap and nfcllcpbuildsdreqtlv pass non-null- terminated strings to prdebug using the %s format specifier. The buffers are allocated via kmemdup or come...

CVE-2026-98526

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...

CVE-2026-98824

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98516

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98802

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

CVE-2026-98803

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

CVE-2026-98473

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...