CVE-2026-97609

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nfctsettimeout protects the timeout hook dereference and policy lookup with rcureadlock. cttimeoutexit, however, unregisters the per-net operations before it clears the hook...

CVE-2026-97607

In the Linux kernel, the following vulnerability has been resolved: vdpa: ifcvf: Put device on unsupported feature error Route unsupported provisioned features through the common error path after vdpaallocdevice so the allocated device and adapter pointer are released consistently...

CVE-2026-97606

In the Linux kernel, the following vulnerability has been resolved: fs: autofs: fix memory leak in autofsfillsuper In autofsfillsuper, we create a new inode using autofsnewino, however, if we fail to create rootinode, that is, rootinode failure path, we return -ENOMEM without freeing the new...

CVE-2026-97604

In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info-cmap and performs the usercopy after dropping info-lock. vfbremove frees the colormap immediately after unregistering the framebuffer...

CVE-2026-97603

In the Linux kernel, the following vulnerability has been resolved: idpf: disable DIM work before freeing qvectors idpf never drains the Tx/Rx DIM works before freeing the memory they live in. txdim and rxdim are embedded in struct idpfqvector, they are queued from the NAPI poll via netdim, and...

CVE-2026-97602

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdirpreexit flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before highthresh was cleared can then acquire the...

CVE-2026-97600

In the Linux kernel, the following vulnerability has been resolved: ieee802154: cc2520: fix FIFOP work use-after-free The FIFOP interrupt handler queues cc2520fifopirqwork. On removal, cc2520remove only flushes the work. The devm-managed FIFOP IRQ remains active until after -remove returns and ca...

CVE-2026-97601

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

CVE-2026-97599

In the Linux kernel, the following vulnerability has been resolved: ieee802154: hwsim: serialize pib updates to fix double-free hwsimupdatepib does an unserialized read-swap-free of phy-pib: pibold = rtnldereferencephy-pib; ... rcuassignpointerphy-pib, pib; kfreercupibold, rcu; It assumes the RTN...

CVE-2026-97597

In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6flowlabelget allocates an ipv6flsocklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease...

CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

CVE-2026-97596

In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template...

CVE-2026-97594

In the Linux kernel, the following vulnerability has been resolved: landlock: Fix use-after-free of the source's parent directory currentcheckreferpath reads olddentry-dparent without holding a reference nor a lock on it, and then dereferences it in collectdomainaccesses and in the audit record. ...

CVE-2026-97593

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...

CVE-2026-97592

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm In function ctraescrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of...

CVE-2026-97590

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with PAES algorithm In function ctrpaesdocrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of unwanted...

CVE-2026-97591

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine When a request is transferred to the engine via cryptotransferhashrequesttoengine there are two return codes signaling a successful transfer:...

CVE-2026-97589

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix wrong return code to engine in asynch callbacks When cryptofinalizehashrequest or cryptofinalizeskcipherrequest explicitly completes a request, the doonerequest callback must return 0 to indicate successful...

CVE-2026-97587

In the Linux kernel, the following vulnerability has been resolved: perf: RISC-V: store available counter mask as bitmap The available-counter mask was a single unsigned long, but iteration uses RISCVMAXCOUNTERS, which is 64. On RV32 that reads past the object. Filling with an unsigned-long bit a...

CVE-2026-97588

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to cryptofinalizerequest. The crypto API's completion wrapper treats -EBU...