EUVD-2026-86922

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6xpdmdmaclose acp6xpdmdmaclose does not free the runtime-privatedata buffer allocated in acp6xpdmdmaopen. Add the missing kfree...

CVE-2026-98091 btrfs: detach failed sprout device from transaction update list

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, createchunk adds the new device to the transaction devupdatelist through device-postcommitlist. If th...

CVE-2026-98092 ASoC: amd: yc: fix memory leak in acp6x_pdm_dma_close()

In the Linux kernel, the following vulnerability has been resolved: ASoC: amd: yc: fix memory leak in acp6xpdmdmaclose acp6xpdmdmaclose does not free the runtime-privatedata buffer allocated in acp6xpdmdmaopen. Add the missing kfree...

CVE-2026-98091 btrfs: detach failed sprout device from transaction update list

In the Linux kernel, the following vulnerability has been resolved: btrfs: detach failed sprout device from transaction update list When creating the first metadata chunk for a sprout filesystem, createchunk adds the new device to the transaction devupdatelist through device-postcommitlist. If th...

CVE-2026-98091

The Linux kernel contains a vulnerability in btrfs where a failed sprout filesystem setup leads to a use-after-free condition. Specifically, when create_chunk() adds a new device to the dev_update_list via device->post_commit_list, a subsequent failure in system chunk creation causes btrfs_ini...

CVE-2026-98090 btrfs: restore active device pointers after failed sprout

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

CVE-2026-98090 btrfs: restore active device pointers after failed sprout

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

CVE-2026-98090

The Linux kernel contains a vulnerability in the btrfs filesystem where btrfs_init_new_device() switches the latest_dev and s_bdev pointers from a seed device to a new sprout device. If chunk creation or sprout setup fails, the error path releases the new device without restoring these pointers. ...

EUVD-2026-86920

In the Linux kernel, the following vulnerability has been resolved: btrfs: restore active device pointers after failed sprout btrfsinitnewdevice switches latestdev and possibly sbdev from the seed device to the new sprout device before creating the first writable chunks. If chunk creation or the...

CVE-2026-98088

The Linux kernel contains an out-of-bounds array read vulnerability within the scsi: mpt3sas driver. The issue occurs in the _base_assign_reply_queues() function because dev_to_node() can return NUMA_NO_NODE (-1) on systems lacking NUMA topology information (e.g., certain single-socket boards). T...

EUVD-2026-86918

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

EUVD-2026-86919

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

CVE-2026-98089

The Linux kernel contains a vulnerability in the bonding driver's alb component. Specifically, the function alb_determine_nd() incorrectly uses icmp6_hdr(skb) to inspect ICMPv6 headers. In certain xmit paths, such as those using AF_PACKET or raw sockets , the skb->transport_header is not guara...

CVE-2026-98089 bonding: alb: fix uninitialized transport header access in alb_determine_nd()

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

CVE-2026-98088 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

EUVD-2026-86916

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98087 sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

CVE-2026-98087

The Linux kernel contains a vulnerability where the RT balancer enters a retry loop when handling migrate_disable() 'd Real-Time (RT) tasks. Because these tasks remain on the pushable list while being pinned, the scheduler repeatedly attempts to push them, fails, and falls back to pushing the cur...

EUVD-2026-86917

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...