CVE-2026-98195 wifi: iwlegacy: fix broadcast stations deallocation

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: fix broadcast stations deallocation On the error path of il4965up, ildeallocbcaststations clears only ILSTAUCODEACTIVE, leaving ILSTABCAST set. This causes the same broadcast stations to be deallocated again by...

CVE-2026-98192

The Linux kernel contains a potential use-after-free vulnerability in the wcn36xx wifi driver during the TX ack timer teardown. The wcn36xx_dxe_deinit() function uses timer_delete(), which dequeues the timer but fails to wait for a callback already in execution. Consequently, the wcn36xx_dxe_tx_t...

CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

EUVD-2026-93120

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98192

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98192 wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: wcn36xx: Fix potential use-after-free in TX ack timer teardown wcn36xxdxedeinit tears down the TX ack timer with timerdelete, which only dequeues the timer and does not wait for a callback that is already executing; the...

CVE-2026-98180

The Linux kernel contains a vulnerability in the drm/msm driver where msm_ringbuffer_destroy() and msm_gem_vm_free() use kfree() instead of kfree_rcu() to release objects containing a drm_gpu_scheduler . Because the scheduler fence maintains a .release callback, it is not ops-detached upon signal...

EUVD-2026-93108

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98180 drm/msm: RCU-free the scheduler-containing ring and VM objects

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98180

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98180 drm/msm: RCU-free the scheduler-containing ring and VM objects

In the Linux kernel, the following vulnerability has been resolved: drm/msm: RCU-free the scheduler-containing ring and VM objects Both struct msmringbuffer and struct msmgemvm embed a struct drmgpuscheduler. msmringbufferdestroy and the VM free callback msmgemvmfree call drmschedfini on the...

CVE-2026-98178 drm/amdgpu: Skip KFD mapping clear before initialization

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpuamdkfdclearkfdmapping assumes that a non-NULL kfddev has a fully populated node array. This is not true when KFD device initialization fails after probe. For example,...

CVE-2026-98178 drm/amdgpu: Skip KFD mapping clear before initialization

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Skip KFD mapping clear before initialization amdgpuamdkfdclearkfdmapping assumes that a non-NULL kfddev has a fully populated node array. This is not true when KFD device initialization fails after probe. For example,...

EUVD-2026-93103

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175

The Linux kernel contains a use-after-free vulnerability in the SMB client component. The root cause is that the clean_demultiplex_info() function fails to cancel the server->reconnect delayed work, while it does cancel server->echo. This allows a use-after-free to occur when the demultiple...

CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175 smb: client: cancel reconnect work in clean_demultiplex_info()

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98175

In the Linux kernel, the following vulnerability has been resolved: smb: client: cancel reconnect work in cleandemultiplexinfo cleandemultiplexinfo cancels server-echo delayed work but not server-reconnect, which can cause a use-after-free when the demultiplex thread exits while a reconnect work ...

CVE-2026-98173 smb: client: fix use-after-free of iface in cifs_try_adding_channels()

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free of iface in cifstryaddingchannels cifstryaddingchannels iterates ses-ifacelist with listforeachentrysafefrom, which captures the next entry niface under ifacelock. The loop body then drops ifaceloc...

CVE-2026-98173

The Linux kernel contains a use-after-free vulnerability in the SMB client component within the cifs_try_adding_channels() function. The issue arises because the function captures the next entry (niface) under iface_lock but then drops the lock for the duration of cifs_ses_add_channel(). A concur...