CVE-2026-98750

The Linux kernel contains a vulnerability in the tty subsystem where a race condition between closing a TTY (saving its termios) and the re-registration of a device can occur. This happens when a minor number is reused for a different device, potentially leading to a use-after-free condition. To ...

CVE-2026-98750 tty: fix saved termios reset race

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

EUVD-2026-103835

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98750 tty: fix saved termios reset race

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

EUVD-2026-103964

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710

The Linux kernel contains a memory leak vulnerability in the wifi: iwlegacy: 3945 driver. Specifically, while the il3945_pci_probe() function calls il_eeprom_init() to allocate memory for EEPROM data, the remove path fails to release this memory after a successful probe. This results in EEPROM da...

CVE-2026-98549

A flaw in the Linux kernel TCP subsystem allows skbs queued after a transition to hardware-assisted encryption to be improperly merged with unencrypted packets in the retransmission queue. This occurs because tcp_write_collapse_fence() may fail to prevent collapsing across boundaries. Practical c...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

EUVD-2026-103594

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

EUVD-2026-103753

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: Fix runtime PM leak in nouveauconnectordetect If nvifoutpedidget fails, nouveauconnectordetect returns early without dropping the runtime PM reference taken at the start of the function, keeping the device powered on...

DEBIAN-CVE-2026-98436

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly...

CVE-2026-98436

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Disable device buffer exporting Device buffers are never intended to be exported. Disable exporting support explicitly...

CVE-2026-98433

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uvpagein failure In kvmppcsvmpagein, if uvpagein fails after kvmppcuvmemgetpage has succeeded, the secure device page is never released. kvmppcuvmemgetpage sets a bit in...

CVE-2026-98474 s390/pci: Fix missing device lock in zpci_report_status()

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

EUVD-2026-103714

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

CVE-2026-98474

The Linux kernel contains a vulnerability in the s390/pci subsystem where the zpci_report_status() function fails to hold the necessary device lock when accessing a device's driver (specifically when pdev is non-NULL). This missing lock can lead to inconsistent states during recovery. The fix inv...

CVE-2026-98474 s390/pci: Fix missing device lock in zpci_report_status()

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...