CVE-2026-98057

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

CVE-2026-98055

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails sndhdacextbusgetmlcapabilities may fail and its return code shall be checked and accounted for. Address the issue by updating the error-path for avspciprobe. At the...

CVE-2026-98056

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

CVE-2026-98053

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix initconfig access Existing code accesses enties found in -initconfigs array through indexes that are part of -configids array. Those two are limited by: -numinitconfigs and -numconfigids...

CVE-2026-98052

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98050

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98049

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98047

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

CVE-2026-98048

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

CVE-2026-98045

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-98046

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

CVE-2026-98044

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98043

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

CVE-2026-98042

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collectlinkedregs checkcondjmpop copies the compared registers into env-false,truereg1,2 before collectlinkedregs runs and copies those snapshots back into both branch states afterwards...

CVE-2026-98040

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark the zero register precise for a register-form NULL check checkcondjmpop accepts "if rA rB" as a NULL check for a nullable pointer rA when rB is a scalar known to be zero, lifts PTRMAYBENULL from rA in the corresponding...

CVE-2026-98041

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...

CVE-2026-98039

In the Linux kernel, the following vulnerability has been resolved: bpf: Require MEMPERCPU for percpu kptr stores mapkptrmatchtype treats permflags as the set of register type flags that a kptr field permits. Adding MEMPERCPU to that set for BPFKPTRPERCPU does not require the source register to...

CVE-2026-98037

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject untrusted allocated-object pointers When the final RCU read-side critical section ends, a local kptr is demoted to PTRUNTRUSTED but retains MEMALLOC. The pointer may be NULL or may refer to an object whose lifetime is...

CVE-2026-98038

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcountacquire nullable for borrowed RCU kptrs bpfrefcountacquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KFRETNULL on the return value...