EUVD-2026-86964

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

EUVD-2026-86965

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98134

The Linux kernel BPF verifier contains a logic error in check_cond_jmp_op() where it incorrectly infers that a pointer is non-null. This occurs during comparisons (e.g., rA == rB) when one pointer type lacks the PTR_MAYBE_NULL flag but can still be NULL at runtime, such as types like PTR_TO_MEM. ...

CVE-2026-98133 ntfs: leave HasEA flag untouched on setxattr failure

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

EUVD-2026-86963

In the Linux kernel, the following vulnerability has been resolved: bpf: don't downgrade half-dead scalar zero spills to STACKZERO states.c:cleanfuncstate can downgrade scalar zero spill to STACKZERO in the following case: u64 r10 - 8 = 0; ... checkpoint ... r1 = u32 r10 - 4; ... no reads from...

EUVD-2026-86962

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...

CVE-2026-98131

The Linux kernel contains a DMA mapping leak within the stmmac_tso_xmit() function. When a DMA mapping for an skb fragment fails, the system drops the frame but fails to unmap the DMA mappings already established for the linear part and preceding fragments. This flaw leads to a persistent leak of...

CVE-2026-98132

The Linux kernel bpf verifier contains a flaw in states.c:__clean_func_state() where it can incorrectly downgrade half-dead scalar zero spills to STACK_ZERO. Specifically, when 4 bytes of a 64-bit spill are dead, the verifier changes the spill to a combination of zero and poison values (0000pppp)...

CVE-2026-98130

A Time-of-Check to Time-of-Use (TOCTOU) race condition exists in the Linux kernel 's SCTP implementation within the SCTP_CMD_TIMER_START handler. The handler checks timer_pending() before calling timer_reduce(), but the timer can expire and detach between these actions. This causes timer_reduce()...

EUVD-2026-86961

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach between these operations, causing timerreduce to rearm the timer without...

CVE-2026-98130 sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START

In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTPCMDTIMERSTART The SCTPCMDTIMERSTART handler checks timerpending before calling timerreduce. The timer can expire and detach between these operations, causing timerreduce to rearm the timer without...

EUVD-2026-86959

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

CVE-2026-98129 scsi: mpi3mr: Fix NULL pointer dereference in mpi3mr_sas_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98128

A refcount leak exists in the Linux kernel 's scsi: mpi3mr component within the mpi3mr_sas_port_add() function. The mpi3mr_get_tgtdev_by_addr() function increments the target device kref , but if a subsequent error triggers the out_fail path, the reference is not released because mpi3mr_tgtdev_pu...

CVE-2026-98129

A NULL pointer dereference exists in the Linux kernel 's scsi: mpi3mr component. The function sas_port_alloc_num() may return NULL during a memory allocation failure, but the return value is passed to sas_port_add() without a necessary null check, triggering the dereference. Additionally, a memor...

EUVD-2026-86960

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98127

A vulnerability in the Linux kernel smb/client allows the smb3_insert_range() function to bypass size limits because it fails to validate the new file size. Specifically, it does not check if i_size + len is valid, enabling FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE , exceed s_maxbytes , or re...

EUVD-2026-86958

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3insertrange does not check if the new file size isize + len is valid. This allows FALLOCFLINSERTRANGE to bypass RLIMITFSIZE, exceed smaxbytes, or produce a size outside the lofft...

CVE-2026-98126

A vulnerability in the Linux kernel smb/client allows a file to grow beyond the caller's file-size limit. When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE , the smb3_zero_range() function may extend the EOF without checking RLIMIT_FSIZE . The issue is resolved by calling inode_newsiz...

EUVD-2026-86957

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...