CVE-2026-98067

The Linux kernel 's erofs filesystem was found to have a broken optimization where LZ4 rolling decompression could compromise data correctness. This occurred because the upstream LZ4 implementation might copy long literals backward on x86 systems, violating the rolling window assumption. To ensur...

CVE-2026-98067 erofs: disable LZ4 rolling decompression for now

In the Linux kernel, the following vulnerability has been resolved: erofs: disable LZ4 rolling decompression for now LZ4 rolling decompression 1 was introduced to reduce the memory footprint of temporary pages: For many cases, it is needed for users to read small data within a compressed extent...

EUVD-2026-86818

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

EUVD-2026-86799

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

CVE-2026-97945

The Linux kernel contains a vulnerability in x86 memory management where PMD-mapped Huge Transparent Pages (THP) can experience data loss. The root cause is that pmd_modify() incorrectly masks out the hardware dirty bit (_PAGE_DIRTY). This causes the kernel to lose the dirty state of a page when ...

CVE-2026-97945 x86/mm: Fix user-space data loss with MADV_FREE and THP

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

CVE-2026-97945

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

CVE-2026-97929

The Linux kernel contains a vulnerability in the ALSA: usbusx2y driver within the i_usx2y_in04_int() function. The driver fails to validate urb->actual_length , allowing a malfunctioning device to trigger a short transfer. This causes the handler to process uninitialized heap data from the kma...

CVE-2026-97929 ALSA: usbusx2y: validate URB actual_length in interrupt callback

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

EUVD-2026-86783

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

EUVD-2026-86751

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emitrendercacheflush sets PIPECONTROL0HDCPIPELINEFLUSH to flush the L2/HDC data cache before fence signalling, but it never requests a flush of the LSC untyped L1...

CVE-2026-97620 drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Flush LSC untyped L1 dataport cache after rcs/ccs batches emitrendercacheflush sets PIPECONTROL0HDCPIPELINEFLUSH to flush the L2/HDC data cache before fence signalling, but it never requests a flush of the LSC untyped L1...

CVE-2026-97620

The Linux kernel contains a vulnerability in the drm/xe driver where the emit_render_cache_flush() function failed to request a flush of the LSC untyped L1 dataport cache . While HDC Pipeline Flush was historically expected to handle this, newer platforms like MTL and BMG no longer maintain this ...

CVE-2026-97592 s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with AES ctr and gcm algorithm In function ctraescrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of...

CVE-2026-97583

In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afsfsprobefileserver fetches the current endpoint state under server-fslock, but leaves oldalist as NULL. Consequently, afssetpeerappdata treats every address list...

CVE-2026-97547 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-97547 xfs: fix exchange-range reflink flag clearing issue with INO1_WRITTEN

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

EUVD-2026-86855

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-97547

The Linux kernel contains a vulnerability in the XFS filesystem related to xmi_can_exchange_reflink_flags(). When exchanging two full-file ranges with the XFS_EXCHMAPS_INO1_WRITTEN flag set, the system may incorrectly move the reflink inode flag . This occurs because the operation can skip hole a...

CVE-2026-97542 xfs: bail out on bitmap errors in xrep_agfl_fill

In the Linux kernel, the following vulnerability has been resolved: xfs: bail out on bitmap errors in xrepagflfill LOLLM also points out that the xagbbitmapset call in xrepagflfill can fail, but we don't check the result of xagbbitmapwalk, so we silently drop the error and proceed with inconsiste...