EUVD-2026-86984

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98152 nvmet-rdma: fix queue leak when connect backlog is exceeded

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: fix queue leak when connect backlog is exceeded When pending disconnecting queues exceed the backlog limit, the connect path only drops the device reference and leaks the newly allocated queue and its IB resources...

CVE-2026-98153 nvme: fix racy access to FDP placement id array

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98153

The Linux kernel contains a race condition in the nvme driver related to the FDP placement id array . The function nvme_query_fdp_info() is called per-path, allowing two concurrent paths scanning the same namespace to race when populating head->nr_plids and head->plids for FDP registration....

CVE-2026-98151 bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

EUVD-2026-86982

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

CVE-2026-98151

The Linux kernel contains a vulnerability in the BPF subsystem where a REG INVARIANTS VIOLATION occurs during speculative pointer arithmetic. The root cause is an inconsistency between var_off and the 32-bit range (r32) during the execution of sanitize_ptr_alu(). Specifically, the r32 register is...

EUVD-2026-86980

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

CVE-2026-98150 bpf: Fix BPF_F_CPU validation for sparse CPU IDs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...

EUVD-2026-86981

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...

CVE-2026-98149 bpf: Fix percpu map update indexing with sparse CPU IDs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix percpu map update indexing with sparse CPU IDs Per-CPU array, hash, and cgroup storage map updates without BPFFCPU or BPFFALLCPUS use a value buffer whose per-CPU slots are packed in possible-CPU order. The buffer is siz...

CVE-2026-98149

The Linux kernel contains a vulnerability in the BPF subsystem related to how per-CPU array, hash, and cgroup storage maps are updated. When these maps are updated without the BPF_F_CPU or BPF_F_ALL_CPUS flags, the system uses a value buffer where slots are packed in possible-CPU order . However,...

CVE-2026-98150

The Linux kernel contains a vulnerability in the BPF subsystem where bpf_map_check_op_flags() incorrectly validates BPF_F_CPU flags. Instead of checking against a bound on CPU IDs, it compares the ID against num_possible_cpus(). This allows for the incorrect acceptance of CPU IDs in sparse config...

CVE-2026-98150 bpf: Fix BPF_F_CPU validation for sparse CPU IDs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...

EUVD-2026-86979

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

CVE-2026-98148

The Linux kernel contains a vulnerability in the drm/gud driver where drm_plane_create_rotation_property() fails to validate if the GUD_ROTATION_0 bit is present in the device's reported rotation bitmask. When the rotation argument is set to DRM_MODE_ROTATE_0 but the device omits GUD_ROTATION_0 f...

CVE-2026-98148 drm/gud: validate GUD_ROTATION_0 is present in supported rotations

In the Linux kernel, the following vulnerability has been resolved: drm/gud: validate GUDROTATION0 is present in supported rotations The rotation argument to drmplanecreaterotationproperty is set to DRMMODEROTATE0, and the device reported rotation bitmask is used as the supportedrotations argumen...

CVE-2026-98147 printk: Don't WARN on kthread_run failure.

In the Linux kernel, the following vulnerability has been resolved: printk: Don't WARN on kthreadrun failure. Since kthreadcreateonnode returns -EINTR upon SIGKILL, we should not use WARNON in order to catch kthreadrun failure...

CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98146

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...