CVE-2026-98088

The Linux kernel contains an out-of-bounds array read vulnerability within the scsi: mpt3sas driver. The issue occurs in the _base_assign_reply_queues() function because dev_to_node() can return NUMA_NO_NODE (-1) on systems lacking NUMA topology information (e.g., certain single-socket boards). T...

EUVD-2026-86919

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

CVE-2026-98089

The Linux kernel contains a vulnerability in the bonding driver's alb component. Specifically, the function alb_determine_nd() incorrectly uses icmp6_hdr(skb) to inspect ICMPv6 headers. In certain xmit paths, such as those using AF_PACKET or raw sockets , the skb->transport_header is not guara...

CVE-2026-98088 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

CVE-2026-98089 bonding: alb: fix uninitialized transport header access in alb_determine_nd()

In the Linux kernel, the following vulnerability has been resolved: bonding: alb: fix uninitialized transport header access in albdeterminend albdeterminend uses icmp6hdrskb to inspect ICMPv6 headers. However, in xmit paths e.g. packets sent via AFPACKET / raw sockets or forwarded packets,...

EUVD-2026-86916

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98087 sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

EUVD-2026-86917

In the Linux kernel, the following vulnerability has been resolved: sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate A migratedisable'd RT task cannot be moved to another CPU, but the scheduler still keeps such a task on that CPU's pushable list rq-rt.pushabletasks and still...

CVE-2026-98086

The Linux kernel contains a vulnerability in the ALSA subsystem related to the UMP component. The function snd_ump_parse_endpoint() incorrectly sets ump->parsed on every exit, including errors, before the legacy rawmidi device is attached. Consequently, ump_handle_ep_name_msg() may treat parse...

CVE-2026-98087

The Linux kernel contains a vulnerability where the RT balancer enters a retry loop when handling migrate_disable() 'd Real-Time (RT) tasks. Because these tasks remain on the pushable list while being pinned, the scheduler repeatedly attempts to push them, fails, and falls back to pushing the cur...

CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98085 bpf: backtrack_insn(): Handle ld_{abs,ind} subprog exit edge

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

EUVD-2026-86915

In the Linux kernel, the following vulnerability has been resolved: bpf: backtrackinsn: Handle ldabs,ind subprog exit edge Nicholas Carlini reported a bug in precision backtracking mechanism for BPFLD | BPFIND,ABS instructions. These instructions are modelled as two branches: - fallthrough; -...

CVE-2026-98085

The Linux kernel contains a vulnerability in the BPF precision backtracking mechanism affecting BPF_LD | BPF_{IND,ABS} instructions. The root cause is that the backtrack_insn() function fails to handle the implicit exit case from a subprogram. Specifically, it does not call bt_subprog_enter() whe...

EUVD-2026-86914

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

CVE-2026-98083 btrfs: fix transaction use-after-free in raid stripe insertion

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the transaction before returning -ENOMEM. btrfsfinishoneordered, the production...

CVE-2026-98084

The Linux kernel contains a vulnerability in the BPF verifier related to bpf_loop(). When processing callbacks, the verifier is intended to mark register R1 (which tracks loop iterations) as precise to satisfy callback_depth

CVE-2026-98084 bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: backtracking shouldn't clear outer frame R1-R5 for callbacks When processing calls to bpfloop verifier marks R1 and R4 as precise. R1 tracks loop iterations number and because of the 'callbackdepth R1' mechanics in...

EUVD-2026-86913

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the transaction before returning -ENOMEM. btrfsfinishoneordered, the production...