CVE-2026-98423 wifi: mac80211_hwsim: don't hand frames to mac80211 while stopping

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: don't hand frames to mac80211 while stopping The code checks -started for frames coming from wmediumd, but the radio can be stopped after the check and before frame delivery, causing mac80211 to hit the...

CVE-2026-98422

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the AP_VLAN tailroom counter is not properly managed. Specifically, on ifup , AP_VLAN interfaces inherit the crypto_tx_tailroom_needed_cnt from the AP interface, but this counter is never decremented unless the AP its...

CVE-2026-98421

The Linux kernel contains a vulnerability in the wifi: mac80211 component regarding TDLS setup confirm . The issue occurs because the system may attempt to send a setup confirm to a station that does not exist, triggering a WARN_ON_ONCE(!sta || !ap_sta) warning during frame construction. To resol...

EUVD-2026-101070

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARNONONCE!sta || !apsta Only accept...

CVE-2026-98421 wifi: mac80211: require a peer station for TDLS setup confirm

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARNONONCE!sta || !apsta Only accept...

CVE-2026-98422 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the APVLAN tailroom counter on ifdown On ifup, APVLAN interfaces get cryptotxtailroomneededcnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the...

EUVD-2026-101071

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the APVLAN tailroom counter on ifdown On ifup, APVLAN interfaces get cryptotxtailroomneededcnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the...

CVE-2026-98422 wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reset the APVLAN tailroom counter on ifdown On ifup, APVLAN interfaces get cryptotxtailroomneededcnt from the AP interface, but it's never decremented again unless the AP is also brought down. Thus, bringing the...

CVE-2026-98421 wifi: mac80211: require a peer station for TDLS setup confirm

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: require a peer station for TDLS setup confirm It's nonsense for the setup confirm to go to station that doesn't even exist, and it hits a warning when building the frame: WARNONONCE!sta || !apsta Only accept...

EUVD-2026-101069

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

CVE-2026-98420 ksmbd: follow SMB2 session expiration semantics

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

CVE-2026-98420

The Linux kernel 's ksmbd component contains a vulnerability where the ksmbd_session_register() function incorrectly destroys valid sessions after ten seconds of inactivity during a new SessionSetup exchange. This occurs because the system confuses Session.IdleTime with Session.ExpirationTime . T...

CVE-2026-98419

The Linux kernel contains an out-of-bounds write vulnerability within the drop_monitor component, specifically in the reset_per_cpu_data() function. The issue arises because the variable al includes the 4-byte struct nlattr header size during buffer allocation via genlmsg_new(). However, since nl...

EUVD-2026-101068

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

CVE-2026-98419 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

CVE-2026-98420 ksmbd: follow SMB2 session expiration semantics

In the Linux kernel, the following vulnerability has been resolved: ksmbd: follow SMB2 session expiration semantics ksmbdsessionregister destroys valid sessions after ten seconds of inactivity whenever a client starts another SessionSetup exchange. This confuses Session.IdleTime with...

CVE-2026-98419 drop_monitor: fix out-of-bounds write in reset_per_cpu_data()

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: fix out-of-bounds write in resetpercpudata In resetpercpudata, al is computed as: al = sizeofstruct netdmalertmsg; al += dmhitlimit sizeofstruct netdmdroppoint; al += sizeofstruct nlattr; skb = genlmsgnewal, GFPKERNE...

EUVD-2026-101067

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

CVE-2026-98418 sched/core: Avoid false migration warning for proxy donors

In the Linux kernel, the following vulnerability has been resolved: sched/core: Avoid false migration warning for proxy donors Proxy execution can move a blocked donor's scheduling context to the lock owner's CPU even when the donor is migration-disabled. The donor does not execute there, and its...

CVE-2026-98418

The Linux kernel contains a logic issue where the sched/core component triggers a false positive migration warning for proxy donors . Specifically, set_task_cpu() warns unconditionally for migration-disabled tasks, but moving a blocked donor's scheduling context to a lock owner's CPU does not vio...