CVE-2026-98445

In the Linux kernel, the following vulnerability has been resolved: xfs: don't let memory failures leak blocks and kill repairs LOLLM complains that a memory allocation failure in xrepnewbtaddblocks results in online repair leaking blocks that were previously allocated to write a new btree, but t...

Pillow Resource Management Error Vulnerability

Pillow versions 4.1.0 to 13.0.0 have a resource management vulnerability. This vulnerability arises when the MSP RLE decoder writes the length output to BytesIO without restricting it to the declared image size. This could allow attackers to consume memory through specially crafted MSP images and...

CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

CVE-2026-98867

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

CVE-2026-98867 dm-pcache: bound the logical key offset from persistent memory

In the Linux kernel, the following vulnerability has been resolved: dm-pcache: bound the logical key offset from persistent memory cachekeydecode takes a key's logical off from the cache device and later indexes reqkeytree-subtrees by it in getsubtree. An off past the device forms a subtree point...

CVE-2026-98867

The Linux kernel is affected by a vulnerability in dm-pcache where the cache_key_decode() function fails to properly validate the logical offset of a key from persistent memory. An offset exceeding the device size allows the creation of a subtree pointer outside the req_key_tree->subtrees[] ar...

CVE-2026-98851

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: drop flowtable reference on init error path nftflowoffloadinit bumps the flowtable use count with nftuseinc before calling nfctnetnsget. When the latter fails, the error is returned as-is and the...

CVE-2026-98842

The Linux kernel contains a vulnerability where the codetag_load_module() function fails to set the error code upon failure. Consequently, load_module() incorrectly returns 0 after the module has been torn down. Additionally, if the module is a livepatch , the mod->klp_info allocated by copy_m...

EUVD-2026-103782

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98842 module: fix lost error code from codetag_load_module()

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

CVE-2026-98842 module: fix lost error code from codetag_load_module()

In the Linux kernel, the following vulnerability has been resolved: module: fix lost error code from codetagloadmodule If codetagloadmodule fails, err is not set to reflect the failure and loadmodule returns 0 after the module has been torn down. Also, if the module is a livepatch, mod-klpinfo...

EUVD-2026-103771

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

CVE-2026-98831

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

CVE-2026-98831

The Linux kernel contains a memory leak vulnerability in the of/overlay component. During the execution of init_overlay_changeset(), if find_target() or the __symbols__ lookup fails mid-process, the target and overlay references for fragments initialized up to that point are not released. This oc...

CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

CVE-2026-98813

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...