CVE-2026-98755

A vulnerability exists in the Linux kernel within the tty: vcc component. The vcc_send_ctl() function fails to fully zero-initialize the stack-allocated struct vio_vcc pkt structure. Specifically, the tag.stype_env field remains uninitialized before being transmitted via ldc_write(), which can re...

CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl()

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

EUVD-2026-103840

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl()

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

EUVD-2026-103829

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98744

In the Linux kernel , a vulnerability exists within the ASoC: codecs: max98363 driver. The stream_config structure is not properly initialized before being passed to the sdw_stream_add_slave() function. This allows the type field to contain garbage data, which is subsequently copied to stream-&gt...

CVE-2026-98743 ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98743 ASoC: codecs: rt1017-sdca-sdw: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

EUVD-2026-103828

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98743

The Linux kernel contains a vulnerability in the ASoC: codecs: rt1017-sdca-sdw component where the stream_config structure is not initialized before being passed to sdw_stream_add_slave(). This allows the type field to contain garbage data , which is subsequently copied to stream->type by sdw_...

CVE-2026-98738 Bluetooth: Serialize SMP remote OOB data access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

CVE-2026-98738 Bluetooth: Serialize SMP remote OOB data access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

CVE-2026-98738

The Linux kernel contains a vulnerability in the Bluetooth stack where build_pairing_cmd() accesses remote OOB (Out-of-Band) data without holding the hdev->lock. This lack of synchronization allows a concurrent management command to unlink and free the data before the SMP (Security Manager Pro...

EUVD-2026-103823

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

CVE-2026-98738

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: Serialize SMP remote OOB data access buildpairingcmd looks up remote OOB data and copies its contents without holding hdev-lock, which serializes the list's writers. After SMP finds an entry, a concurrent management...

CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

CVE-2026-98728

The Linux kernel contains an off-by-four bounds check vulnerability in the tpm2_get_random() function. When a response includes the TPM2_ST_SESSIONS tag, the function skips a 4-byte parameter size field but incorrectly validates the response length against TPM_HEADER_SIZE. This allows a truncated...