EUVD-2026-108881

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

CVE-2026-98917 parisc: Increase kernel stack size to 32kb

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

EUVD-2026-108856

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98900 xen/gntalloc: validate grant count before allocation

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98900 xen/gntalloc: validate grant count before allocation

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98900

The Linux kernel contains a vulnerability in the xen/gntalloc component where the gntalloc_ioctl_alloc() function allocates the grant-id array before verifying if the requested count exceeds the global grant limit. This allows user-controlled allocations to reach kcalloc() even when they should b...

CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

CVE-2026-98893

The Linux kernel contains a vulnerability in the arm_scmi firmware component. The parser fails to verify that the received payload contains the required number of entries based on the sensor description before parsing them. This lack of validation for SENSOR_UPDATE payload sizes can lead to issue...

CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98892

The Linux kernel contains a vulnerability in the arm_scmi firmware component. The BASE_ERROR_EVENT carries a variable number of message reports, where the count is encoded in the error_status . The notification parser incorrectly used this count without verifying if the received payload contained...

CVE-2026-98889

The Linux kernel 's iwlwifi driver contains a vulnerability where scheduled scans built probe requests before the iwl_mvm_scan_fits() check. This allowed oversized Information Elements (IEs) to be copied into a fixed preq buffer without prior length validation . To resolve this, the driver was up...

EUVD-2026-108683

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98882

The Linux kernel contains a vulnerability in the chips-media wave5 driver. If the driver's dec_output_info contains invalid data, it can result in a buffer overflow where the driver writes into invalid memory. Specifically, the wave5_vpu_dec_get_output_info() function in drivers/media/platform/ch...

CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

EUVD-2026-108676

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-98882 media: chips-media: wave5: Add range checks for dec_output_info

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...