CVE-2026-98153 nvme: fix racy access to FDP placement id array

In the Linux kernel, the following vulnerability has been resolved: nvme: fix racy access to FDP placement id array nvmequeryfdpinfo is called per-path and therefore prone to races. It populates head-nrplids/head-plids for fdp registration. But nothing protects that pair from concurrent access -...

CVE-2026-98153

The Linux kernel contains a race condition in the nvme driver related to the FDP placement id array . The function nvme_query_fdp_info() is called per-path, allowing two concurrent paths scanning the same namespace to race when populating head->nr_plids and head->plids for FDP registration....

EUVD-2026-86949

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix readahead synchronisation issues by loading all folios upfront There are some synchronisation issues that derive from the app thread adding more folios to the rolling buffer whilst the collector thread is looking at th...

CVE-2026-98115 ksmbd: safely drain sessions during logoff

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

CVE-2026-98115 ksmbd: safely drain sessions during logoff

In the Linux kernel, the following vulnerability has been resolved: ksmbd: safely drain sessions during logoff SMB3 multichannel allows requests for one session to run on multiple connections. Wait for all channels bound to a session before freeing shared session objects. A deferred byte-range lo...

EUVD-2026-86940

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98109 Bluetooth: hci_core: Fix race condition during device registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98109

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98109 Bluetooth: hci_core: Fix race condition during device registration

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98109

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix race condition during device registration In hciregisterdev, the poweron work item is queued to hdev-reqworkqueue before initializing hdev-advmonitorsidr and registering the MSFT extension via msftregister...

CVE-2026-98101

The Linux kernel contains a vulnerability in the ipv6 multicast implementation where the pmc->sflist is read locklessly under rcu_read_lock() by inet6_mc_check() during packet reception in UDP and RAW multicast receive paths. The root cause is that ip6_mc_source() performs in-place mutation of...

CVE-2026-98101 ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use copy-on-write RCU updates in ip6mcsource pmc-sflist is read locklessly under rcureadlock by inet6mccheck during packet reception in the UDP and RAW multicast receive paths. ip6mcsource mutated psl-sladdr and...

CVE-2026-98099 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98099

The Linux kernel contains a vulnerability in the net/ipv6/mcast.c component where RCU-protected lists (specifically np->ipv6_mc_list , idev->mc_list , and idev->mc_tomb ) are updated using direct pointer assignments instead of the required rcu_assign_pointer() function. This occurs in fu...

CVE-2026-98099 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98099

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98070 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

EUVD-2026-86723

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98070 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98070

The Linux kernel contains a vulnerability in the net/rds component where rds_tcp_reset_callbacks() fails to properly quiesce the transmit path. On weakly ordered architectures, the function's reliance on sampling the RDS_IN_XMIT bit rather than owning it creates a store-buffering pattern. This al...