CVE-2026-98558

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98534

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

CVE-2026-98533

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...

CVE-2026-98795

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98818

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

UBUNTU-CVE-2026-98832

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98535

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98544

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98565

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98569

In the Linux kernel, the following vulnerability has been resolved: ipgre: Reject enabling collect metadata through changelink ipgrenetlinkparms can enable collectmd on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a...

CVE-2026-98516

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix bridge reference leak in nv1aramnew pcigetdomainbusandslot takes a reference to the PCI device, which is never released once the memory size has been read from its config space. Drop the reference before returnin...

CVE-2026-98824

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98509

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98629

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

UBUNTU-CVE-2026-98587

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for isoresourceauto client resource The todo member of isoresourceauto structure represents the state of the client resource and normally transitions in the following order: ISORESAUTOALLOC -...

CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

CVE-2026-98649

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix race in destroypagescrste Use READONCE in destroypagescrste to read the crste, avoid dereferencing the pointer multiple times...

CVE-2026-98532

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98627

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...