CVE-2026-98083

The Linux kernel contains a use-after-free vulnerability within the btrfs filesystem during RAID stripe insertion. The root cause occurs when the allocation of a RAID stripe extent fails; the function btrfs_insert_one_raid_extent() aborts and ends the transaction before returning -ENOMEM. However...

EUVD-2026-86913

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix transaction use-after-free in raid stripe insertion If allocation of a RAID stripe extent fails, btrfsinsertoneraidextent aborts and ends the transaction before returning -ENOMEM. btrfsfinishoneordered, the production...

CVE-2026-98081

A vulnerability exists in the Linux kernel 's btrfs filesystem involving the zoned feature. The root cause is that do_zone_finish() clears the BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE flag but returns early if call_zone_finish() fails. This results in a reference leak for inactive block groups on fs_info-...

EUVD-2026-86912

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

EUVD-2026-86911

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-98082 btrfs: fix the possible bioc_list memory leak during error

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

CVE-2026-98082

The Linux kernel contains a memory leak vulnerability in the btrfs filesystem within btrfs_ordered_extent::bioc_list. The root cause involves bioc_list memory leaking during error conditions, specifically when btrfs_insert_one_raid_extent() fails or when an ordered extent encounters an IO error (...

CVE-2026-98082 btrfs: fix the possible bioc_list memory leak during error

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

CVE-2026-98081 btrfs: zoned: finish active block group cleanup if call_zone_finish() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: zoned: finish active block group cleanup if callzonefinish fails dozonefinish clears BLOCKGROUPFLAGZONEISACTIVE before finishing the zones. If callzonefinish then fails it returned early, leaving the now inactive block gro...

CVE-2026-98080 btrfs: do not force reloc root creation during qgroup_account_snapshot()

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

CVE-2026-98080

The Linux kernel contains a vulnerability in the btrfs filesystem where triggering qgroup_account_snapshot() while quotas are enabled (via MKFS_OPTIONS="-O quota") can cause a kernel warning and flip the filesystem to read-only (RO) . The root cause is a tree reference to a metadata extent that n...

EUVD-2026-86910

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

CVE-2026-98078 ipvs: fix reversed sequence option serialization

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

EUVD-2026-86909

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstdgetworkspace even though a workspace is free. When zstdallocworkspace fails, the task is queued on zwsm-wait and schedules unconditionall...

CVE-2026-98079

The Linux kernel contains a concurrency issue in the btrfs: zstd component where a writer can sleep indefinitely in zstd_get_workspace(). The root cause is a lost wakeup occurring because zstd_alloc_workspace() fails and the task queues unconditionally on zwsm->wait without re-testing the pool...

CVE-2026-98078

The Linux kernel contains a vulnerability in the ipvs component related to incorrect sequence option serialization. The hton_seq() function expects host-order source and network-order destination arguments, but the version 1 sync sender passes these arguments in reverse. This flaw leaves 24 bytes...

EUVD-2026-86908

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

CVE-2026-98079 btrfs: zstd: fix lost wakeup when waiting for a workspace

In the Linux kernel, the following vulnerability has been resolved: btrfs: zstd: fix lost wakeup when waiting for a workspace A writer can sleep forever in zstdgetworkspace even though a workspace is free. When zstdallocworkspace fails, the task is queued on zwsm-wait and schedules unconditionall...

CVE-2026-98076 tracing/probes: Fix use-after-free on field name/type of events with multiple probes

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

CVE-2026-98077 netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...