CVE-2026-98262 ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as so...

CVE-2026-98263 ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

EUVD-2026-93191

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98263

The Linux kernel contains a vulnerability in the ASoC: codecs: rt712-sdca-dmic component. The root cause is that the stream_config structure is not initialized before being passed to sdw_stream_add_slave() , allowing the type field to contain garbage values. This uninitialized data is subsequentl...

CVE-2026-98263 ASoC: codecs: rt712-sdca-dmic: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98262

The Linux kernel libahci driver contains a functional issue where the JMicron JMB585 becomes unusable when the AHCI_HFLAG_32BIT_ONLY flag is used. The root cause is that for HBAs supporting 64-bit addressing, the PxCLBU and PxFBU registers have implementation-specific reset values; however, when ...

CVE-2026-98262 ata: libahci: clear PxCLBU and PxFBU for AHCI_HFLAG_32BIT_ONLY

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as so...

EUVD-2026-93190

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as so...

EUVD-2026-93189

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifschanskipordisable When a secondary channel is no longer supported by the server, cifschanskipordisable drops the channel reference with cifsputtcpsession and then continues to use the server...

CVE-2026-98261

A use-after-free vulnerability exists in the Linux kernel within the cifs component. The issue occurs in cifs_chan_skip_or_disable() when a secondary channel is no longer supported by the server; the function drops the channel reference using cifs_put_tcp_session() but continues to use the server...

CVE-2026-98261 cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifschanskipordisable When a secondary channel is no longer supported by the server, cifschanskipordisable drops the channel reference with cifsputtcpsession and then continues to use the server...

CVE-2026-98261 cifs: Fix server use-after-free in cifs_chan_skip_or_disable()

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifschanskipordisable When a secondary channel is no longer supported by the server, cifschanskipordisable drops the channel reference with cifsputtcpsession and then continues to use the server...

CVE-2026-98259 fs/dax: check zero or empty entry before converting xarray entry

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98259

The Linux kernel is vulnerable to a kernel panic when booting a VM with DAX enabled storage . The issue is caused by calling dax_to_folio() with an empty entry , which occurs in the fs/dax component. Specifically, the vulnerability persists in dax_associate_entry(), dax_disassociate_entry(), and ...

CVE-2026-98259 fs/dax: check zero or empty entry before converting xarray entry

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

EUVD-2026-93187

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98260 exec: Cleanup POSIX timers right after de_thread()

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98260

The Linux kernel is vulnerable to a use-after-free condition during the execve() system call. The issue occurs when a non-leader thread executes; while de_thread() changes the PID ownership, a per-thread CPU timer node remains queued on the original thread's posix_cputimers. If subsequent operati...

EUVD-2026-93188

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

CVE-2026-98260 exec: Cleanup POSIX timers right after de_thread()

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...