CVE-2026-98007 bpf: Reject non-scalar bpf_loop iteration counts

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

CVE-2026-98007 bpf: Reject non-scalar bpf_loop iteration counts

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

CVE-2026-97978

The Linux kernel contains a vulnerability in the eth: ice driver where the ice_tx_dim_work event triggers a double dereference in TP_printk(). This occurs because the tracing subsystem attempted to access pointers (specifically the ring or dim instance) long after the event was recorded, resultin...

CVE-2026-97970

The Linux kernel contains a vulnerability within the watchdog: msc313e component where the clk_get_rate() function could return 0, potentially leading to a division by zero panic . This issue has been resolved in the kernel to prevent system instability. No specific exploit information or exploit...

CVE-2026-97970 watchdog: msc313e: Avoid division by zero

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-97970 watchdog: msc313e: Avoid division by zero

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

EUVD-2026-86824

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97941

A race condition exists in the Linux kernel memory management system within mm/slab. The __slab_try_return_freelist() function incorrectly assumed that no objects were freed to a slab if slab->freelist was NULL and cmpxchg succeeded. This oversight leads to a classic ABA problem where a slab c...

CVE-2026-97934 tracing: Fix memory corruption from a "STACKTRACE" histogram key

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

CVE-2026-97934

The Linux kernel is vulnerable to memory corruption within the tracing subsystem. The issue arises because generic fields like "STACKTRACE" are mapped to placeholders instead of NULL by parse_field() . Consequently, create_hist_field() interprets data from the common_type field as an offset, lead...

EUVD-2026-86788

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

CVE-2026-97566 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

CVE-2026-97566 mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

CVE-2026-97537

The Linux kernel contains a vulnerability in the scsi qla2xxx driver within the qla25xx_free_req_que() and qla25xx_free_rsp_que() functions. Two specific issues occur on the error path of queue creation: first, an unconditional dma_free_coherent() call with a NULL pointer (resulting from a dma_al...

EUVD-2026-86845

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

CVE-2026-97537 scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

CVE-2026-97537 scsi: qla2xxx: Fix queue teardown NULL dma_free and bitmap locking

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Fix queue teardown NULL dmafree and bitmap locking qla25xxfreereqque and qla25xxfreerspque have two pre-existing bugs exposed on the error path of qla25xxcreatereq,rspque: 1. When dmaalloccoherent fails during queu...

CVE-2026-97528

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver where the function qla_nvme_xmt_ls_rsp() fails to unlink the uctx node from the fcport->unsol_ctx_head list before freeing it with kfree() during an LS reject error path. This results in a use-after-free condition where the ...

CVE-2026-97528 scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Unlink NVMe unsol ctx before freeing on LS reject error qlanvmexmtlsrsp obtains uctx, which was linked into fcport-unsolctxhead by qla2xxxprocesspurlsiocb and is still linked when the NVMe transport calls back to...