CVE-2026-98683 smb: client: flush dirty data before zeroing a range

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

EUVD-2026-103937

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98683 smb: client: flush dirty data before zeroing a range

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98659 iio: pressure: rohm-bm1390: Return error when read fails

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

CVE-2026-98659 iio: pressure: rohm-bm1390: Return error when read fails

In the Linux kernel, the following vulnerability has been resolved: iio: pressure: rohm-bm1390: Return error when read fails The data reading function ignores the cached error value, and unconditionally returns 0. Return cached 'ret' -value after stopping the measurement so user knows if read...

CVE-2026-98659

The Linux kernel contains a vulnerability in the iio: pressure: rohm-bm1390 driver where the data reading function ignores cached error values and unconditionally returns 0. This causes the system to potentially return garbage data to the user instead of indicating a read failure. The fix involve...

CVE-2026-98658

In the Linux kernel, the following vulnerability has been resolved: iio: proximity: aw96103: validate firmware data length The firmware parser reads a length from the binary header and then uses it to walk six-byte register/value entries. A truncated firmware image can make the parser read beyond...

CVE-2026-98600 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

CVE-2026-98600 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

CVE-2026-98600

The Linux kernel Bluetooth RFCOMM component contains a vulnerability in rfcomm_recv_frame() related to how it handles short EA=0 frames. When a frame with an extended 2-byte length field (requiring a 5-byte minimum) arrives as a 4-byte frame, the initial length check passes, but subsequent proces...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

EUVD-2026-103628

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98583

The Linux kernel contains a vulnerability in the nfc: nfcmrvl component regarding the firmware download receive path. The root cause is that the system removes the NCI data header and reads the helper command before validating the remaining packet length. This allows a short frame to reach the da...

CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98479

A vulnerability exists in the Linux kernel iSCSI TCP subsystem where the iscsi_tcp_hdr_dissect() function fails to verify the expected data transfer direction before copying a Data-In PDU into a command's scatterlist. A malicious or compromised iSCSI storage server can exploit this by sending a D...

EUVD-2026-103719

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98479

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98479 scsi: libiscsi_tcp: Check the data direction of a Data-In PDU

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-110886

Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms allows Object Injection.This issue affects Conversational Forms for ChatBot: from n/a through 1.5.1...