CVE-2026-98539 fs/ntfs3: use d_instantiate_new() in ntfs_create_inode() and murder syzbot's "WARNING in do_new_mount" saga

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

CVE-2026-98539

The Linux kernel 's ntfs3 filesystem component contains a vulnerability where ntfs_create_inode() incorrectly interacts with d_instantiate() . Specifically, calling unlock_new_inode() after d_instantiate() causes lockdep_annotate_inode_mutex_key() to reset the i_rwsem count and owner while anothe...

EUVD-2026-103584

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: use dinstantiatenew in ntfscreateinode and murder syzbot's "WARNING in donewmount" saga ntfscreateinode creates a new inode via ntfsnewinode. It hashes it with insertinodelocked and so it's marked as INEW until...

CVE-2026-98537

The Linux kernel contains a vulnerability in the workqueue subsystem where the check_flush_dependency() function performs a NULL pointer dereference . The issue occurs because current_wq_worker() confirms the process is a workqueue worker, but the worker->current_pwq pointer remains NULL if th...

CVE-2026-98538

The Linux kernel contains a performance issue in the writeback subsystem where the cleanup_offline_cgwb() function performs a quadratic drain of inodes. This occurs because the function repeatedly walks wb->b_attached and wb->b_dirty_time from the same end, causing it to rescanned a growing...

CVE-2026-98538 writeback: bound cleanup_offline_cgwb() rescans by rotating scanned inodes

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...

CVE-2026-98537 workqueue: Fix NULL current_pwq deref in flush dependency check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

EUVD-2026-103583

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...

EUVD-2026-103582

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in flush dependency check checkflushdependency uses currentwqworker to determine whether the caller is a workqueue worker and then dereferences worker-currentpwq to test whether the current...

CVE-2026-98536

The Linux kernel contains a vulnerability where a worker draining a cgwb with millions of attached inodes fails to report a Tasks-RCU quiescent state during each drain pass. Due to how cond_resched() behaves on CONFIG_PREEMPTION kernels (specifically arm64 and x86 architectures in lazy mode), the...

CVE-2026-98536 writeback: report a Tasks-RCU quiescent state per cgwb drain pass

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

EUVD-2026-103581

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-98535 fsl/fman: Fix clk reference leak in read_dts_node()

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98535

The Linux kernel contains a clock reference leak within the fsl/fman component in the read_dts_node() function. The issue occurs because of_clk_get() increments a clock's reference count, but the function fails to call clk_put() after reading the rate. Since the clock is not stored, the reference...

EUVD-2026-103580

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98534 ipe: fix use-after-free when auditing a newly loaded policy

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

CVE-2026-98534

A use-after-free vulnerability exists in the Linux kernel within the ipe component. The issue occurs because new_policy() audits a policy after ipe_new_policyfs_node() publishes it and releases the new directory's inode lock . This allows a concurrent delete operation to free the policy while ipe...

EUVD-2026-103579

In the Linux kernel, the following vulnerability has been resolved: ipe: fix use-after-free when auditing a newly loaded policy newpolicy audits the policy after ipenewpolicyfsnode publishes it and drops the new directory's inode lock. A concurrent delete can free the policy while...

CVE-2026-98533

A vulnerability was identified in the Linux kernel involving the dm-verity component. Specifically, the function ipe_bdev_setintegrity() incorrectly freed the old root hash when publishing a new one on ->preresume , while policy evaluation could still be dereferencing the old hash. The issue h...

CVE-2026-98533 ipe: protect the dm-verity root hash with RCU

In the Linux kernel, the following vulnerability has been resolved: ipe: protect the dm-verity root hash with RCU ipebdevsetintegrity frees the old root hash when dm-verity publishes a new one on -preresume, while policy evaluation can still be dereferencing it. Protect the root hash with RCU. Th...