CVE-2026-98053

The Linux kernel contains an out-of-bounds access vulnerability within the ASoC: Intel: avs component. The flaw exists in the avs_path_module_send_init_configs() function, where the code accesses entries in the ->init_configs array using indexes from the ->config_ids array. Because these ar...

CVE-2026-98054 ASoC: Intel: avs: Fix unbalanced module reference count

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

EUVD-2026-86706

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix initconfig access Existing code accesses enties found in -initconfigs array through indexes that are part of -configids array. Those two are limited by: -numinitconfigs and -numconfigids...

CVE-2026-98053 ASoC: Intel: avs: Refactor and fix init_config access

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix initconfig access Existing code accesses enties found in -initconfigs array through indexes that are part of -configids array. Those two are limited by: -numinitconfigs and -numconfigids...

EUVD-2026-86707

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

CVE-2026-98052 net: bcmasp: clear txcb->last before writing each descriptor

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

EUVD-2026-86705

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98052 net: bcmasp: clear txcb->last before writing each descriptor

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98052

A vulnerability exists in the Linux kernel 's bcmasp network driver. The bcmasp_xmit() function fails to clear the txcb->last field for non-final fragments of an SKB , leaving stale data in the descriptor slot. This can cause bcmasp_tx_reclaim() to incorrectly identify a mid-SKB fragment as th...

CVE-2026-98050

The Linux kernel contains a vulnerability in the mlxsw: spectrum_ptp component where mlxsw_sp1_ptp_ht_gc_collect() calls napi_gro_receive() from a PTP garbage-collection workqueue instead of the NAPI poll context. This leads to a race condition because the call mutates the NAPI instance's GRO lis...

CVE-2026-98050 mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

CVE-2026-98050 mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

EUVD-2026-86703

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

CVE-2026-98051

The Linux kernel contains a vulnerability in the bcmasp networking component within the tx_spb_ring_full() function. The root cause is an improper loop initialization where next_index was reset on every iteration, causing the function to repeatedly test the same descriptor slot instead of checkin...

EUVD-2026-86704

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98051 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98049 bpf: zero extend the result of an arena 32-bit cmpxchg

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

EUVD-2026-86702

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98049

The Linux kernel contains a vulnerability where an arena 32-bit cmpxchg operation fails to perform a required zero extension. The root cause is that is_cmpxchg_insn() only matches BPF_ATOMIC, causing arena operations rewritten to BPF_PROBE_ATOMIC by bpf_convert_ctx_accesses() to miss the necessar...

CVE-2026-98049 bpf: zero extend the result of an arena 32-bit cmpxchg

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...