CVE-2026-98159

A vulnerability exists in the Linux kernel 's wifi: mt76: mt7921 driver. The loader fails to properly validate the region count and individual record lengths provided by the CLC firmware . This lack of validation allows a malformed firmware image to cause the region table pointer to precede the f...

EUVD-2026-86989

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

CVE-2026-98158

The Linux kernel contains a vulnerability in the ppp_async component where the frame-error path in process_input_packet() incorrectly resets a reused skb's headroom to zero. This violates the NET_SKB_PAD guarantee, leading to a kernel panic (filter under-panic) or an out-of-bounds read when CCP c...

EUVD-2026-86988

In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...

CVE-2026-98157

The Linux kernel contains a vulnerability in the EDAC/device_sysfs component where the poll_msec sysfs store file uses simple_strtoul(). Because simple_strtoul() accepts an unsigned long while the target field is an unsigned int , values exceeding UINT_MAX on 64-bit systems are silently truncated...

CVE-2026-98157 EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation

In the Linux kernel, the following vulnerability has been resolved: EDAC/devicesysfs: Use kstrtouint for pollmsec to prevent truncation The pollmsec sysfs store file uses simplestrtoul which accepts an unsigned long, but the target field pollmsec is unsigned int. On 64-bit systems, a value UINTMA...

CVE-2026-98158 ppp_async: drop the errored frame instead of resetting its headroom

In the Linux kernel, the following vulnerability has been resolved: pppasync: drop the errored frame instead of resetting its headroom pppreceivenonmpframe prepends a two-byte direction tag before running the pass/active BPF filters: be16 skbpushskb, 2 = htonsPPPFILTERINBOUNDTAG; Nothing on the...

CVE-2026-98156 drm/virtio: use the DMA API for resource backing on Xen

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...

CVE-2026-98156

The Linux kernel contains a vulnerability in the drm/virtio component when running on Xen . The root cause is that virtio-gpu independently determines whether to use the DMA API based solely on a feature bit. Because QEMU does not set iommu_platform on virtio-vga by default, the system fails to n...

EUVD-2026-86987

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use the DMA API for resource backing on Xen On a Xen PV domain page addresses bear no relation to the real machine addresses the host would have to use to reach it. virtioring.c handles this correctly, vringusemapapi...

CVE-2026-98155

The Linux kernel contains a vulnerability in the accel/qaic driver where the resp_worker() function could perform an out-of-bounds read . The root cause is that a previous commit skipped the bounds checking code found in decode_message() while handling DBC deactivation. A malformed wire message s...

EUVD-2026-86986

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in respworker Although 'commit 2feec5ae5df7 "accel/qaic: Handle DBC deactivation if the owner went away"' fixes the scenario it was intended for by walking the message and only...

EUVD-2026-86985

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

CVE-2026-98154 nvme-rdma: fix -EIO cleanup order in queue_rq

In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queuerq On -EIO, the RDMA queuerq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double...

CVE-2026-98154

The Linux kernel contains a vulnerability in the nvme-rdma component related to the queue_rq path. When a -EIO error occurs, the path incorrectly reports a host path error but continues to clean up the command and unmap the SQE DMA . Because the path error helper already completes the request, th...

EUVD-2026-86983

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

CVE-2026-98153 nvme: fix racy access to FDP placement id array

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98152

The Linux kernel contains a vulnerability in the nvmet-rdma component where a queue leak occurs when the connect backlog is exceeded. Specifically, when pending disconnecting queues surpass the backlog limit, the connect path incorrectly drops only the device reference, resulting in the leakage o...

EUVD-2026-86984

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98153

The Linux kernel contains a race condition in the nvme driver related to the FDP placement id array . The function nvme_query_fdp_info() is called per-path, allowing two concurrent paths scanning the same namespace to race when populating head->nr_plids and head->plids for FDP registration....