EUVD-2026-103705

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98465 RISC-V: KVM: Serialize IMSIC attributes with vCPU migration

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98465

A flaw in the Linux kernel 's KVM subsystem for the RISC-V architecture allows a local user with KVM interface access to trigger a race condition during concurrent vCPU migration. Because KVM device ioctls are not serialized against KVM_RUN , the kvm_riscv_aia_imsic_rw_attr() function can snapsho...

CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

EUVD-2026-103704

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98464 RISC-V: KVM: Synchronize hrtimer callback during teardown

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98464

A use-after-free vulnerability exists in the Linux kernel 's KVM implementation for the RISC-V architecture. A race condition occurs during virtual machine teardown where a non-Sstc hrtimer callback clears the next_set flag before its final use of the enclosing vCPU . This allows kvm_riscv_vcpu_t...

EUVD-2026-103703

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98463 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98463 sched_ext: Derive SCX_RQ_IN_WAKEUP from the core enqueue flags

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98463

The Linux kernel contains a vulnerability within the sched_ext framework where SCX_RQ_IN_WAKEUP is incorrectly derived from merged enqueue flags. Specifically, move_remote_task_to_local_dsq() sets this flag without a subsequent task_woken_scx() call, causing deferred actions to remain pending. Th...

CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

CVE-2026-98462 Bluetooth: hci_conn: fix CIS hold ownership on reuse

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

EUVD-2026-103702

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

CVE-2026-98462

The Linux kernel Bluetooth stack contains a flaw in how CIS hold ownership is handled during reuse. Specifically, the functions hci_bind_cis() and hci_connect_cis() may fail to correctly manage ISO layer holds. In hci_bind_cis(), holds are currently taken only after CIS configuration, leading to ...

CVE-2026-98461 Bluetooth: hci_sock: validate event length before filtering

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

CVE-2026-98461 Bluetooth: hci_sock: validate event length before filtering

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

EUVD-2026-103701

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

CVE-2026-98461

The Linux kernel contains a vulnerability in the Bluetooth subsystem within the hci_sock component. The is_filtered_packet() function performs an out-of-bounds read by accessing skb->data[0] without verifying the socket buffer is non-empty. Additionally, when an opcode filter is active, it rea...

CVE-2026-98460 Bluetooth: hci_sock: reject out-of-range OCF values

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...