CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

EUVD-2026-103811

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

EUVD-2026-103809

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

CVE-2026-98724

The Linux kernel contains a vulnerability in the nvmet driver related to pci-epf SGL segments. A host-controlled SGL segment length that is nonzero but smaller than a single SGL descriptor causes nr_descs to become zero. This leads the function nvmet_pci_epf_get_sgl_segment() to perform an out-of...

CVE-2026-98711

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

EUVD-2026-103965

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98711

The Linux kernel contains a vulnerability in the wifi: cw1200 driver where the TX path rounds the transfer size up to the bus alignment (up to 511 bytes for SDIO, 1 byte for SPI) but fails to reserve room in the frame buffer for the padding. This causes cw1200_data_write() to perform an out-of-bo...

CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98702 wifi: mac80211: reject invalid 320 MHz CSA bandwidth

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

CVE-2026-98702 wifi: mac80211: reject invalid 320 MHz CSA bandwidth

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

EUVD-2026-103956

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: reject invalid 320 MHz CSA bandwidth The HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a received CSA frame on a non-6 GHz link. It warns for this unsupported width but...

CVE-2026-98702

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the HT/VHT channel definition validator can receive a 320 MHz bandwidth indication from a CSA frame on a non-6 GHz link. The system warns about the unsupported width but proceeds with an uninitialized vht_operation.ch...

CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98690

The Linux kernel contains a vulnerability in the thunderbolt driver where a domain reference is leaked when a DPRX read is canceled. Specifically, the tb_tunnel_one_dp() function takes a reference that is only dropped once; if tb_dp_tunnel_active() work is canceled, the reference remains leaked. ...

CVE-2026-98690 thunderbolt: Fix domain reference leak when DPRX read is canceled

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...

CVE-2026-98690

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix domain reference leak when DPRX read is canceled tbtunnelonedp takes a domain reference which is only dropped once tbdptunnelactive has run on the work queue. If that work is cancelled that reference is leaked...