CVE-2026-98764

The Linux kernel contains a NULL pointer dereference vulnerability within the usb gadget f_fs component, specifically in FUNCTIONFS_ENDPOINT_DESC . The issue occurs when user space initializes FunctionFS with only full-speed descriptors while the gadget operates at a higher speed (e.g., USB_SPEED...

EUVD-2026-103849

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98764 usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

EUVD-2026-103841

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98756 usb: cdns3: Fix NULL pointer dereference in cdns3_pci_probe

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98756

The Linux kernel contains a vulnerability in the Cadence USBSS controller (cdns3) driver. The issue is a NULL pointer dereference occurring during the probing of a two-function PCI device. Specifically, when the second function is probed while the first function has been enabled but has not yet i...

EUVD-2026-103838

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98753

The Linux kernel contains a vulnerability in the tty_port component where the TTY_IO_ERROR flag is not restored upon activation failure. This oversight creates a race condition during tty ioctl , hangup, and open operations. If activation fails, the lack of this flag can lead to I/O attempts on p...

CVE-2026-98753 tty: tty_port: restore TTY_IO_ERROR on activation failure

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

EUVD-2026-103837

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98752 tty: port: fix tty_port_tty_vhangup() race

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98752

The Linux kernel contains a race condition in the tty_port_tty_vhangup() function. This issue occurs when the function races with another hangup, potentially returning before the port is fully shut down. This flaw can lead to use-after-free and NULL-pointer dereferences during racing ioctls (incl...

CVE-2026-98747

The Linux kernel contains a NULL pointer dereference vulnerability in the serial_core_unregister_port() function. The issue occurs because port->port_dev is NULL when no port device is installed—either because it was cleared during teardown or never set due to a registration failure in serial_...

CVE-2026-98747 serial: core: fix NULL pointer dereference in serial_core_unregister_port()

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

EUVD-2026-103832

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

CVE-2026-98747

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

CVE-2026-98719

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Nullify "have run CPUs" mask pointer when freeing it Nullify haveruncpus when freeing the mask, particularly in the error path of sevguestinit, so that KVM doesn't have to subtly use sev-active to track whether or not t...

CVE-2026-98717 KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98717

The Linux kernel KVM component is vulnerable to a NULL pointer dereference within the x86/mmu shadow page table walking logic. The issue occurs when a race condition exists between memslot creation and a stage-2 page fault (EPT violation or #NPF) from L2. If the root is a "dummy" root—where the t...