EUVD-2026-103705

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98464

The Linux kernel contains a race condition in the RISC-V KVM implementation where a non-Sstc hrtimer callback clears next_set before its final use of the enclosing vCPU . If teardown occurs simultaneously, kvm_riscv_vcpu_timer_cancel() may skip hrtimer_cancel(), allowing kvm_destroy_vcpus() to fr...

CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

EUVD-2026-103704

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98463 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98463

The Linux kernel contains a vulnerability within the sched_ext framework where SCX_RQ_IN_WAKEUP is incorrectly derived from merged enqueue flags. Specifically, move_remote_task_to_local_dsq() sets this flag without a subsequent task_woken_scx() call, causing deferred actions to remain pending. Th...

EUVD-2026-103703

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98462

The Linux kernel Bluetooth stack contains a flaw in how CIS hold ownership is handled during reuse. Specifically, the functions hci_bind_cis() and hci_connect_cis() may fail to correctly manage ISO layer holds. In hci_bind_cis(), holds are currently taken only after CIS configuration, leading to ...

CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

EUVD-2026-103702

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

CVE-2026-98461 Bluetooth: hci_sock: validate event length before filtering

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

CVE-2026-98461

The Linux kernel contains a vulnerability in the Bluetooth subsystem within the hci_sock component. The is_filtered_packet() function performs an out-of-bounds read by accessing skb->data[0] without verifying the socket buffer is non-empty. Additionally, when an opcode filter is active, it rea...

EUVD-2026-103701

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

CVE-2026-98460 Bluetooth: hci_sock: reject out-of-range OCF values

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...

CVE-2026-98460

A vulnerability exists in the Linux kernel 's Bluetooth hci_sock component. The raw HCI socket security filter provides 128 OCF bits per supported OGF but masks the 10-bit OCF with 127 before command lookup. This allows an unprivileged socket to submit a reserved OCF that aliases an allowlisted c...

EUVD-2026-103700

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...

CVE-2026-98459

A vulnerability in the Linux kernel Bluetooth stack allows for a potential use-after-free or premature disconnection. The issue resides in hci_bind_bis() , where the function obtains a parent pointer from hci_conn_hash_lookup_big() without taking an operational hold. Because hci_conn_unlink() lat...

CVE-2026-98459 Bluetooth: ISO: balance the parent hold in hci_bind_bis()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

EUVD-2026-103699

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

CVE-2026-98458

The Linux kernel Bluetooth ISO layer contains a vulnerability where hci_bind_cis() and hci_connect_cis() return an hci_conn hold that may remain unused. Specifically, the hold is not released when iso_chan_add() returns success for an already attached socket (idempotent case) or returns -EBUSY wh...