CVE-2026-98129

A NULL pointer dereference exists in the Linux kernel 's scsi: mpi3mr component. The function sas_port_alloc_num() may return NULL during a memory allocation failure, but the return value is passed to sas_port_add() without a necessary null check, triggering the dereference. Additionally, a memor...

CVE-2026-98128

A refcount leak exists in the Linux kernel 's scsi: mpi3mr component within the mpi3mr_sas_port_add() function. The mpi3mr_get_tgtdev_by_addr() function increments the target device kref , but if a subsequent error triggers the out_fail path, the reference is not released because mpi3mr_tgtdev_pu...

EUVD-2026-86960

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix NULL pointer dereference in mpi3mrsasportadd sasportallocnum can return NULL on memory allocation failure. The return value is passed directly to sasportadd without a NULL check, which causes a NULL pointer...

CVE-2026-98128 scsi: mpi3mr: Fix target device refcount leak in mpi3mr_sas_port_add()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpi3mr: Fix target device refcount leak in mpi3mrsasportadd mpi3mrgettgtdevbyaddr increments the target device kref when it returns a device. If a subsequent error triggers a goto outfail after the tgtdev reference is...

CVE-2026-98127

A vulnerability in the Linux kernel smb/client allows the smb3_insert_range() function to bypass size limits because it fails to validate the new file size. Specifically, it does not check if i_size + len is valid, enabling FALLOC_FL_INSERT_RANGE to bypass RLIMIT_FSIZE , exceed s_maxbytes , or re...

CVE-2026-98127 smb/client: validate new EOF for insert range

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3insertrange does not check if the new file size isize + len is valid. This allows FALLOCFLINSERTRANGE to bypass RLIMITFSIZE, exceed smaxbytes, or produce a size outside the lofft...

EUVD-2026-86958

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for insert range smb3insertrange does not check if the new file size isize + len is valid. This allows FALLOCFLINSERTRANGE to bypass RLIMITFSIZE, exceed smaxbytes, or produce a size outside the lofft...

EUVD-2026-86957

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

CVE-2026-98126

A vulnerability in the Linux kernel smb/client allows a file to grow beyond the caller's file-size limit. When FALLOC_FL_ZERO_RANGE is used without FALLOC_FL_KEEP_SIZE , the smb3_zero_range() function may extend the EOF without checking RLIMIT_FSIZE . The issue is resolved by calling inode_newsiz...

CVE-2026-98126 smb/client: validate new EOF for zero range

In the Linux kernel, the following vulnerability has been resolved: smb/client: validate new EOF for zero range When FALLOCFLZERORANGE is used without FALLOCFLKEEPSIZE, smb3zerorange may extend EOF without checking RLIMITFSIZE, allowing the file to grow beyond the caller's file-size limit. Fix th...

CVE-2026-98125 smb/client: fix stale page cache in insert/collapse range

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-98125

The Linux kernel contains a vulnerability in the smb/client component where smb3_insert_range() and smb3_collapse_range() may return stale data . The issue occurs because truncate_pagecache_range() only partially zeroes boundary pages when the offset or old EOF is not page-aligned , leaving them ...

CVE-2026-98125 smb/client: fix stale page cache in insert/collapse range

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

EUVD-2026-86956

In the Linux kernel, the following vulnerability has been resolved: smb/client: fix stale page cache in insert/collapse range smb3insertrange and smb3collapserange use truncatepagecacherange to invalidate the affected page cache. However, if off or oldeof is not page-aligned, the boundary pages a...

CVE-2026-98124 smb/client: invalidate fscache for fallocate range operations

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through server-side range operations. These operations discard the affected...

CVE-2026-98124

The Linux kernel contains a vulnerability in the smb/client component where specific server-side range operations—smb3_zero_range() , smb3_punch_hole() , smb3_insert_range() , and smb3_collapse_range() —fail to properly invalidate the FS-Cache . While these operations discard the affected page ca...

EUVD-2026-86955

In the Linux kernel, the following vulnerability has been resolved: smb/client: invalidate fscache for fallocate range operations smb3zerorange, smb3punchhole, smb3insertrange, and smb3collapserange modify file contents through server-side range operations. These operations discard the affected...

EUVD-2026-86954

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

CVE-2026-98122

The Linux kernel contains a use-after-free vulnerability in the vxlan module within the vxlan_mdb_remote_src_del() function. The root cause is that vxlan_mdb_is_valid_source() incorrectly accepts the all-zeros address , leading to aliased keys. This allows the first call to free the entry while t...

CVE-2026-98123

The Linux kernel is vulnerable to a remote denial of service (DoS) and an out-of-bounds read due to how SCTP handles ASCONF-ACK parameters. The sctp_verify_asconf() function uses padding during parameter iteration, while the consumer sctp_get_asconf_response() iterates using raw lengths. An odd-l...