CVE-2026-98976

In the Linux kernel, the following vulnerability has been resolved: namespace: keep the lock on a mount that a propagated copy is moved beneath attachrecursivemnt transfers MNTLOCKED from the top mount to the mount that is moved beneath it with MOVEMOUNTBENEATH. This allows the owner of a user...

CVE-2026-98977

In the Linux kernel, the following vulnerability has been resolved: namespace: handle mount locking for automounts correctly If mounts are propagated across user namespaces, attachrecursivemnt locks every copy of the source mount to protect overmounts from vanishing and revealing the underlying...

CVE-2026-98981

In the Linux kernel, the following vulnerability has been resolved: namespace: unhash a dentry before detaching the mounts on it unlink, rmdir and rename remove the entry from the filesystem, call detachmounts on the entry with the inode locked and then call ddelete once the inode is unlocked. Th...

CVE-2026-98968

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98966

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

CVE-2026-98967

In the Linux kernel, the following vulnerability has been resolved: cxgb4/chktls: disable softirqs around tidlist erases chcrktlscplactopenrpl inserts into tidlist from the receive path using xainsertbh. The array is shared by the adapter's connections and initialized with XAFLAGSLOCKBH. However,...

CVE-2026-98969

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

CVE-2026-98965

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql-numqueued, is updated by the ICE driver when it invokes netdevtxsentqueue...

CVE-2026-98959

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfsdiritem item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

CVE-2026-98961

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

CVE-2026-98955

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ? skb-len : hlen; mintu16, ... casts both arguments to u16 before comparin...

CVE-2026-98950

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98949

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98954

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-networkheader' check before flow-dissecting GSO packets without...

CVE-2026-98942

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

CVE-2026-98941

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 "ext4: add checks for large folio incompatibilities when BS PS" disables large folios at mount time if the "encrypt" feature is set. However, enabling that...

CVE-2026-98933

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-98934

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-98935

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98936

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...