CVE-2026-98532

The Linux kernel is vulnerable to an out-of-bounds read and write in the IPv6 processing logic. The ipv6_find_hdr() function walks the extension header chain but fails to check if the skip amount exceeds the packet length (skb->len). This allows the function to return an offset pointing past t...

CVE-2026-98532 ipv6: do not let ipv6_find_hdr() return an offset past the packet end

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

EUVD-2026-103577

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not let ipv6findhdr return an offset past the packet end ipv6findhdr walks the extension header chain, skipping each header by the length that header itself declares. ipv6optlen returns up to 2048, and the skip is never...

CVE-2026-98531

A vulnerability exists in the Linux kernel where the seg6_genl_policy allows a short SEG6_ATTR_DST attribute because it uses NLA_BINARY with a maximum length check. This allows a 16-byte out-of-bounds read past skb->tail into uninitialized memory during a SEG6_CMD_SET_TUNSRC operation. The lea...

CVE-2026-98531 ipv6: sr: enforce exact attribute length for SEG6_ATTR_DST

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

EUVD-2026-103576

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: enforce exact attribute length for SEG6ATTRDST In seg6genlpolicy, SEG6ATTRDST is defined with .type = NLABINARY and .len = sizeofstruct in6addr. For NLABINARY, .len only enforces the maximum payload length and permits...

CVE-2026-98530

The Linux kernel contains a vulnerability where writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized can cause a permanent hang . The issue occurs because the writer sleeps in D state while holding the kprobe_sysctl_mutex, preventing any subsequent reads or writes to...

EUVD-2026-103575

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobesysctlmutex held, so...

CVE-2026-98530 kprobes: Fix permanent hang when flushing the kprobe optimizer

In the Linux kernel, the following vulnerability has been resolved: kprobes: Fix permanent hang when flushing the kprobe optimizer Writing 0 to /proc/sys/debug/kprobes-optimization while a kprobe is jump-optimized never returns. The writer sleeps in D state forever with kprobesysctlmutex held, so...

CVE-2026-98529

The Linux kernel contains a runtime PM reference leak within the arizonas gpio driver. Specifically, when switching a persistent GPIO line from input to output, the system acquires a runtime PM reference on the parent device. If the subsequent regmap_update_bits() function fails, this reference i...

CVE-2026-98529 gpio: arizona: Fix runtime PM leak in arizona_gpio_direction_out()

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizonagpiodirectionout Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmapupdatebits fails the reference ...

EUVD-2026-103574

In the Linux kernel, the following vulnerability has been resolved: gpio: arizona: Fix runtime PM leak in arizonagpiodirectionout Switching a persistent GPIO line from input to output acquires a runtime PM reference on the parent device, but if the subsequent regmapupdatebits fails the reference ...

CVE-2026-98528

The Linux kernel contains a vulnerability in the gpio cdev component where a failure to acquire the GPIO chip guard in gpio_desc_to_lineinfo() causes the function to return prematurely. This results in a kernel stack leak to user-space because the information structure is not zeroed before being ...

CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

EUVD-2026-103573

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98527 gpio: zynq: fix runtime PM leak on request error path

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-98527

The Linux kernel contains a runtime power management (PM) leak within the zynq gpio driver. The issue occurs because pm_runtime_get_sync() increments a usage counter even on failure, while zynq_gpio_request() fails to drop the reference. Because gpiolib fails to call ->free() during a request ...

EUVD-2026-103572

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-98526

The Linux kernel contains a vulnerability in how the llc_alloc_frame() function reserves link-layer headroom. The current implementation uses the device type, which is insufficient for stacked Ethernet devices like VLAN devices . Because vlan_dev_hard_header() inserts a VLAN header before the low...

CVE-2026-98526 llc: reserve device headroom for allocated frames

In the Linux kernel, the following vulnerability has been resolved: llc: reserve device headroom for allocated frames llcallocframe reserves link-layer headroom using the device type. This is insufficient for stacked Ethernet devices such as VLAN devices, where vlandevhardheader pushes a VLAN...