CVE-2026-98839

The Linux kernel contains a vulnerability in the paste_selection() function where a race condition can lead to a slab-out-of-bounds read . Because the selection mutex (vc_sel.lock) is released inside the loop, a concurrent TIOCLINUX (TIOCL_SETSEL) ioctl can replace the selection buffer with a sho...

EUVD-2026-103779

In the Linux kernel, the following vulnerability has been resolved: vt: selection: Fix unsigned underflow and slab-out-of-bounds read in pasteselection In pasteselection, the loop copies mintunsigned int, vcsel.buflen - pasted,tty-receiveroom bytes per iteration into ttyldiscreceivebuf and...

EUVD-2026-103770

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98830

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98828

The Linux kernel contains a vulnerability in the ath9k wifi driver within the ath9k_wmi_rsp_callback() function. The root cause is that the function copies the number of bytes expected by a waiting command into a response buffer without sufficiently verifying the length of the device response. If...

CVE-2026-98828 wifi: ath9k: reject short WMI command responses

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98828 wifi: ath9k: reject short WMI command responses

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

EUVD-2026-103768

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98810

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98810

A slab-out-of-bounds read vulnerability exists in the Linux kernel within the wifi: mac80211 component. The issue occurs in ieee80211_monitor_select_queue() because the code validates packet length using skb->len, which includes non-linear fragments. When AF_PACKET sends a large enough packet ...

EUVD-2026-103895

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98732

The Linux kernel contains a buffer over-read vulnerability in the Bluetooth: btintel driver specifically within the btintel_hw_error() function. The issue occurs because the "Exception info %s" print operation uses skb->data + 1 on a 12-byte payload that is not guaranteed to be NUL-terminated ...

EUVD-2026-103817

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintelhwerror The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s" a...

CVE-2026-98732 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintelhwerror The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s" a...

CVE-2026-98732 Bluetooth: btintel: fix buffer over-read in btintel_hw_error()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintelhwerror The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s" a...

CVE-2026-98732

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: fix buffer over-read in btintelhwerror The "Exception info %s" print uses skb-data + 1, but the 12-byte payload is not guaranteed to be NUL-terminated and can be read past its end. Bound the print with "%.s" a...

CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...