EUVD-2026-86956

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-98125

The Linux kernel contains a vulnerability in the smb/client component where smb3_insert_range() and smb3_collapse_range() may return stale data . The issue occurs because truncate_pagecache_range() only partially zeroes boundary pages when the offset or old EOF is not page-aligned , leaving them ...

CVE-2026-98125 smb/client: fix stale page cache in insert/collapse range

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-98124

The Linux kernel contains a vulnerability in the smb/client component where specific server-side range operations—smb3_zero_range() , smb3_punch_hole() , smb3_insert_range() , and smb3_collapse_range() —fail to properly invalidate the FS-Cache . While these operations discard the affected page ca...

EUVD-2026-86955

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through server-side range operations. These operations discard the affected...

EUVD-2026-86954

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

CVE-2026-98122

The Linux kernel contains a use-after-free vulnerability in the vxlan module within the vxlan_mdb_remote_src_del() function. The root cause is that vxlan_mdb_is_valid_source() incorrectly accepts the all-zeros address , leading to aliased keys. This allows the first call to free the entry while t...

CVE-2026-98123

The Linux kernel is vulnerable to a remote denial of service (DoS) and an out-of-bounds read due to how SCTP handles ASCONF-ACK parameters. The sctp_verify_asconf() function uses padding during parameter iteration, while the consumer sctp_get_asconf_response() iterates using raw lengths. An odd-l...

CVE-2026-98123 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

CVE-2026-98122 vxlan: mdb: Fix use-after-free in vxlan_mdb_remote_src_del()

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbremotesrcdel vxlanmdbisvalidsource, which validates MDBEATTRSOURCE and every MDBEATTRSRCLIST member, accepts the all-zeros address. A source list is only accepted on a , G entry, whose...

EUVD-2026-86953

In the Linux kernel, the following vulnerability has been resolved: vxlan: mdb: Fix use-after-free in vxlanmdbremotesrcdel vxlanmdbisvalidsource, which validates MDBEATTRSOURCE and every MDBEATTRSRCLIST member, accepts the all-zeros address. A source list is only accepted on a , G entry, whose...

CVE-2026-98120

The Linux kernel contains a subrequest reference leak within the netfs_unbuffered_write() function. This issue occurs specifically when subreq->io_iter results in a zero length during the preparation phase. The vulnerability has been resolved in the kernel source. No specific exploit details o...

EUVD-2026-86952

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

CVE-2026-98120

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfsunbufferedwrite in the event that subreq-ioiter ends up zero length during preparation...

EUVD-2026-86951

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix subreq ref leak Fix a subrequest ref leak in netfsunbufferedwrite in the event that subreq-ioiter ends up zero length during preparation...

CVE-2026-98121

The Linux kernel contains a NULL pointer dereference vulnerability in the msc313e watchdog driver. The issue occurs because msc313e_wdt_probe() fails to set the driver data for the platform device, causing dev_get_drvdata() to return NULL during msc313e_wdt_suspend() and msc313e_wdt_resume() call...

CVE-2026-98119

A null-pointer dereference vulnerability exists in the Linux kernel 's netfs component. When netfs_alloc_subrequest() fails during an unbuffered write, it returns a NULL subrequest. The system subsequently attempts to initialize members of this NULL pointer within netfs_prepare_write() , leading ...

EUVD-2026-86950

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

CVE-2026-98118

The Linux kernel contains a synchronization issue within the netfs component related to readahead operations. The root cause involves the app thread adding folios to a rolling buffer while the collector thread is concurrently accessing or attempting to clear them, which can lead to inconsistent s...

EUVD-2026-86949

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at th...