EUVD-2026-86941

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

EUVD-2026-86942

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

CVE-2026-98110

The Linux kernel contains a vulnerability in the Bluetooth btintel driver where the firmware ID is incorrectly treated as a NUL-terminated string. Because the TLV length is the only actual boundary, the snprintf() function may read beyond the received response if a NUL terminator is missing. The ...

EUVD-2026-86940

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98109

A race condition exists in the Linux kernel Bluetooth hci_core component during device registration. Specifically, in hci_register_dev(), the power_on work item is queued before hdev->adv_monitors_idr is initialized and before the MSFT extension is registered via msft_register(). For devices w...

EUVD-2026-86939

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

CVE-2026-98107

The Linux kernel Bluetooth L2CAP component contains an out-of-bounds write vulnerability in l2cap_ecred_connect. The root cause is in l2cap_chan_connect(), where the check for pending ECRED channels incorrectly counts only deferred channels. Specifically, if 6 L2CAP sockets are connected in a spe...

EUVD-2026-86938

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix out-of-bounds write in l2capecredconnect l2capchanconnect tries to ensure there are no more than L2CAPECREDCONNSCIDMAX pending ECRED channels, so they fit in the same L2CAPECREDCONNREQ that l2capecredconnect...

CVE-2026-98108

The Linux kernel Bluetooth L2CAP component contains a vulnerability where l2cap_le_connect_req() fails to correctly set the channel mode, potentially allowing FLAG_DEFER_SETUP channels to send incorrect L2CAP_ECRED_CONN_RSP replies. Furthermore, because the function fails to limit the number of d...

CVE-2026-98108 Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix chan mode for LECONNREQ + EXTFLOWCTL pchan l2capnewconnection sets default value of channel mode to match the parent channel. l2capleconnectreq left this at the default, and created L2CAPMODEEXTFLOWCTL...

EUVD-2026-86936

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oatc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with endvalid bit set, before it runs out o...

CVE-2026-98105

The Linux kernel contains a vulnerability in the oa_tc6 ethernet driver where oversubscribed traffic causing buffer overflow errors can lead to a kernel assert during skb_put. This occurs because the driver fails to identify a data chunk with the end_valid bit set before exhausting sk buffer spac...

CVE-2026-98106

The Linux kernel contains a vulnerability where a device-private folio migrated to system memory by a CPU fault remains reachable through the raw-PFN eviction path until migration finalization. If the same folio is selected for eviction during this window, a second migration attempt occurs, leavi...

EUVD-2026-86937

In the Linux kernel, the following vulnerability has been resolved: drm/pagemap: Prevent double migration of device pages A device-private folio migrated to system memory by a CPU fault can remain reachable through the raw-PFN eviction path until migration finalization drops the source reference...

EUVD-2026-86935

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

CVE-2026-98104

The Linux kernel contains a vulnerability in the net/sched: cls_u32 component where the node ID pool can become exhausted. When the pool is full, gen_new_kid() fails to report an error and instead returns a maximum value, leading u32_change() to insert a duplicate handle into the hash table. Simi...

EUVD-2026-86934

In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ipsflist to RCU Commit 23d2b94043ca "igmp: Add ipmclist lock in ipcheckmcrcu" added spinlockbh&im-lock to ipcheckmcrcu to prevent a use-after-free while iterating im-sources during concurrent deletions...

CVE-2026-98103 igmp: convert struct ip_sf_list to RCU

In the Linux kernel, the following vulnerability has been resolved: igmp: convert struct ipsflist to RCU Commit 23d2b94043ca "igmp: Add ipmclist lock in ipcheckmcrcu" added spinlockbh&im-lock to ipcheckmcrcu to prevent a use-after-free while iterating im-sources during concurrent deletions...

CVE-2026-98103

The Linux kernel is affected by a vulnerability where a previous fix to prevent a use-after-free condition in the igmp component introduced a lockdep recursive locking warning or deadlock . Specifically, the ip_check_mc_rcu() function attempted to acquire &im->lock while &pmc->lock was alre...

CVE-2026-98102 ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: fix RCU list diversion in ip6mcdel1src When removing a source filter whose count reaches zero, ip6mcdel1src unlinks psf from pmc-mcasources. If the filter was previously active, the code moved psf directly into...