EUVD-2026-101066

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98417

The Linux kernel contains a vulnerability where ESP-in-TCP can process xfrm packets with transport header offsets that no longer fit after the stream parser trims the TCP envelope. This issue occurs because the plain transport header reset truncates the offset, triggering the skb warning path . T...

CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

EUVD-2026-101065

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98416 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98417 net: xfrm: reject unrepresentable espintcp transport headers

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

CVE-2026-98416 dmaengine: ti: k3-udma-glue: fix NULL dereference in k3_udma_glue_release_rx_chn()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma-glue: fix NULL dereference in k3udmagluereleaserxchn If devmkcalloc for rxchn-flows fails in a channel request function, the error path calls k3udmagluereleaserxchn, which dereferences the NULL rxchn-flows...

CVE-2026-98416

The Linux kernel contains a NULL dereference vulnerability within the dmaengine driver specifically affecting ti: k3-udma-glue . The issue occurs in the k3_udma_glue_release_rx_chn() function; if devm_kcalloc() fails to allocate rx_chn->flows , the error path triggers a dereference of the NULL...

CVE-2026-98414 memcg: avoid charging the root memcg from obj_cgroup_charge_pages()

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

EUVD-2026-101064

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98414

The Linux kernel contains a vulnerability where obj_cgroup_charge_pages() fails to short-circuit the root memcg . Due to how memcg_reparent_objcgs() redirects objcg->memcg during an rmdir operation, an objcg from a dying child of the root can resolve to the root memcg while passing obj_cgroup_...

CVE-2026-98415

The Linux kernel contains a use-after-free vulnerability within the soc: samsung: exynos-pmu driver. Specifically, the setup_cpuhp_and_cpuidle() function incorrectly decrements the reference count of the interrupt generation block node using of_node_put() immediately after fetching the resource a...

CVE-2026-98414 memcg: avoid charging the root memcg from obj_cgroup_charge_pages()

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

CVE-2026-98415 soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node

In the Linux kernel, the following vulnerability has been resolved: soc: samsung: exynos-pmu: fix use-after-free of interrupt generator node The setupcpuhpandcpuidle parses the device tree node for the interrupt generation block via ofparsephandle and decrements its reference count using ofnodepu...

EUVD-2026-101063

In the Linux kernel, the following vulnerability has been resolved: memcg: avoid charging the root memcg from objcgroupchargepages objcgroupchargepages resolves the objcg to its memcg and calls trychargememcg, which does not short circuit the root memcg. That memcg can be the root memcg:...

CVE-2026-98413 selinux: always fill AVC decision in avc_has_perm_noaudit()

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...

EUVD-2026-101062

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...

CVE-2026-98413

The Linux kernel contains a vulnerability in the selinux component within the avc_has_perm_noaudit() function. The issue is caused by an early return for an empty requested permission set, which leaves the @avd buffer untouched. This results in callers receiving an uninitialized stack variable , ...

CVE-2026-98413 selinux: always fill AVC decision in avc_has_perm_noaudit()

In the Linux kernel, the following vulnerability has been resolved: selinux: always fill AVC decision in avchaspermnoaudit avchaspermnoaudit is documented to return a copy of the access decision in @avd, but its early return for an empty requested permission set leaves the buffer untouched. All...