CVE-2026-97447

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance OEM ID and Table ID validation in acpiexloadtableop Enhance OEM ID and Table ID validation in acpiexloadtableop to prevent buffer overflows...

CVE-2026-97446

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpinscustompackage acpinscustompackage unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Type !=...

CVE-2026-97445

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validation in acpiutwalkamlresources Enhance buffer validation in acpiutwalkamlresources to prevent buffer overflows...

CVE-2026-97444

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in two places Add boundary checks in acpipsgetnextnamestring and acpipspeekopcode to prevent out-of-bounds access...

CVE-2026-97443

In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in unregisterftracefunction perfftracefunctionunregister unconditionally calls unregisterftracefunction without checking whether the ftraceops was ever successfully registered. This triggers a WARNON in...

CVE-2026-97442

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

CVE-2026-97441

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

CVE-2026-97440

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix node refcount leak on ctrl packet alloc failure qrtrsendresumetx calls qrtrnodelookup which takes a reference on the returned node. If the subsequent call to qrtrallocctrlpacket fails due to memory allocation...

CVE-2026-97439

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: preserve non-DOS attribute bits in system.dosattrib BUG A corrupted ntfs3 image can hit a NULL function pointer call in genericperformwrite after toggling system.ntfsattrib and then overwriting system.dosattrib on the...

CVE-2026-97438

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds BUG A malformed NTFS directory index entry can advertise a keysize larger than the bytes actually present in its NTFSDE payload. Directory lookup then passes that malformed key to...

CVE-2026-97437

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

CVE-2026-97436

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2switchportsetfdb function always allocates a new FDB for the port which is becoming standalone. In case no FDB is found, then the port leaving...

CVE-2026-97435

In the Linux kernel, the following vulnerability has been resolved: net: dsa: sja1105: flower: reject cross-chip redirect dsaportfromnetdev may return a valid port from a different switch chip. Programming another chip's port index into the local hardware causes redirection to the wrong port, or ...

CVE-2026-97434

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix handling of NAPI on the remove path All the NAPI instances for a DPSW device are attached to the first switch port's netdevice but shared by all ports. The NAPI instances get disabled only once the last port goe...

CVE-2026-97433

In the Linux kernel, the following vulnerability has been resolved: nvme: validate FDP configuration descriptor sizes Validate descriptor sizes while walking the FDP configurations log so dsze == 0 or a descriptor past the log end cannot cause unbounded iteration or reads past the buffer...

CVE-2026-97432

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix P2P-Device binding handling Our binding handling for P2P-Device can run into the following scenario, as observed by our testing: - a station interface is connected on some channel - the P2P-Device does a...

CVE-2026-97431

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Avoid DPMS-on for phantom stream Why & How Calling dcupdateplanesandstream separately for stream and its phantom stream causes a NULL pointer dereference, since the phantom is destroyed on the first call. Skip th...

CVE-2026-97430

In the Linux kernel, the following vulnerability has been resolved: xhci: Prevent queuing new commands if xhci is inaccessible Refuse to queue a new command on the command ring if xHC is marked inaccessible with the HCDFLAGHWACCESSIBLE. HCDFLAGHWACCESSIBLE is set and cleared in suspend and resume...

CVE-2026-97429

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: fix UAF race in destroyqueuecpsch waitondestroyqueue drops locks to wait for queue resume, allowing a concurrent destroy to free the queue. Use isbeingdestroyed flag to serialize destruction...

CVE-2026-97428

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: harden FRU PIA parsing with bounded helpers Replace the open-coded TLV walk with frupiaadvance and frupiacopyfield helpers that bound every read by the actual EEPROM data length, preventing out-of-bounds reads on...