EUVD-2026-103941

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98687

The Linux kernel thunderbolt driver contains a heap out-of-bounds read vulnerability in the tb_xdp_properties_request() function. A malicious peer can set an XDomain length field to 63, leading the driver to treat the data as 48 dwords despite only allocating room for 45. This mismatch causes mem...

CVE-2026-98687 thunderbolt: Reject oversized XDomain properties responses

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Reject oversized XDomain properties responses tbxdppropertiesrequest allocates room for 45 data dwords in its 252-byte response buffer. The XDomain length field is six bits wide, however, and a malicious peer can set...

CVE-2026-98658 iio: proximity: aw96103: validate firmware data length

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

EUVD-2026-103912

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

CVE-2026-98658

The Linux kernel contains a vulnerability in the iio: proximity: aw96103 driver where the firmware parser fails to properly validate the length field from the binary header. A truncated firmware image can cause the parser to read beyond the buffer, while a value smaller than the four-byte count f...

CVE-2026-98658 iio: proximity: aw96103: validate firmware data length

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

CVE-2026-98654

Removed by vendor...

CVE-2026-98648

The Linux kernel contains an out-of-bounds read vulnerability in the s390/uv component. The issue occurs when the system contains more than 85 secrets, as the uv_secret_list struct array only holds up to 85 items per page. This causes an out-of-bounds read in the find_secret_in_page function if t...

EUVD-2026-103562

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secr...

CVE-2026-98648 s390/uv: Prevent potential out-of-bounds read

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secr...

CVE-2026-98648 s390/uv: Prevent potential out-of-bounds read

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secr...

CVE-2026-98648

In the Linux kernel, the following vulnerability has been resolved: s390/uv: Prevent potential out-of-bounds read When the system has more than 85 secrets, the uvsecretlist struct array only holds up to 85 items per page, resulting in an out of bounds read in findsecretinpage if the targeted secr...

CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98643

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98643

The Linux kernel is vulnerable to an out-of-bounds read within the bpf subsystem. Specifically, a sockops program reading skops->rtt_min fails to verify the socket type. On the tcp_conn_request() path, sock_ops->sk is a request_sock (non-full), but the context rewrite incorrectly casts it t...

EUVD-2026-103557

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98631

The Linux kernel contains a vulnerability in the xsk component within the xsk_map_gen_lookup() function. The root cause is the use of BPF_JMP_IMM to compare a 32-bit key against max_entries. Because BPF immediates are sign-extended to 64 bits, a max_entries value of 0x80000000 or higher creates a...