CVE-2026-98062 bpf: Mark signal tracepoint siginfo arguments as scalar

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

CVE-2026-98061 bpf: Reject tail calls directly from callback frames

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject tail calls directly from callback frames A tail call from a non-zero frame is modeled as a return from that frame. The verifier makes R0 unknown and calls preparefuncexit for the taken branch. When the current frame i...

CVE-2026-98060 bpf: Reject resilient lock operations in rbtree callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject resilient lock operations in rbtree callbacks bpfrbtreeadd keeps parent and link pointers live across calls to the program-supplied comparison callback. The verifier therefore requires the root's lock to remain held...

CVE-2026-98058 bpf: Mark syscall helpers as sleepable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

CVE-2026-98059 bpf: Mark sched_process_wait argument as nullable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

CVE-2026-98057 ring-buffer: Add checking nr_subbufs to persistent ring buffer validation

In the Linux kernel, the following vulnerability has been resolved: ring-buffer: Add checking nrsubbufs to persistent ring buffer validation Sashiko reported that the code was using meta-nrsubbufs without making sure that it matched the nrpages + 1 on data that was assuming the two were the same...

CVE-2026-98056 nvme: remove stale namespaces by NSID range during scan

In the Linux kernel, the following vulnerability has been resolved: nvme: remove stale namespaces by NSID range during scan nvmescannslist drops the stale namespaces in each gap in the reported NSID list one NSID at a time. Every iteration calls nvmefindgetns to look the namespace up and removes ...

CVE-2026-98055 ASoC: Intel: avs: Clean up the bus when fetching ML caps fails

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Clean up the bus when fetching ML caps fails sndhdacextbusgetmlcapabilities may fail and its return code shall be checked and accounted for. Address the issue by updating the error-path for avspciprobe. At the...

CVE-2026-98054 ASoC: Intel: avs: Fix unbalanced module reference count

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

CVE-2026-98053 ASoC: Intel: avs: Refactor and fix init_config access

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Refactor and fix initconfig access Existing code accesses enties found in -initconfigs array through indexes that are part of -configids array. Those two are limited by: -numinitconfigs and -numconfigids...

CVE-2026-98052 net: bcmasp: clear txcb->last before writing each descriptor

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98050 mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

CVE-2026-98051 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98049 bpf: zero extend the result of an arena 32-bit cmpxchg

In the Linux kernel, the following vulnerability has been resolved: bpf: zero extend the result of an arena 32-bit cmpxchg bpfconvertctxaccesses rewrites an atomic on an arena pointer from BPFSTX | BPFATOMIC to BPFSTX | BPFPROBEATOMIC, and it runs before bpfoptsubregzextlo32rndhi32. That pass emi...

CVE-2026-98048 bpf: don't rewrite bpf_fastcall patterns entered by a jump

In the Linux kernel, the following vulnerability has been resolved: bpf: don't rewrite bpffastcall patterns entered by a jump markfastcallpatternforcall must ensure that matched "spill; call; fill" instruction series is not interrupted by a jump. Otherwise the rewrite applied by...

CVE-2026-98047 bpf: Check ancestor frames for rbtree callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Check ancestor frames for rbtree callbacks bpfrbtreeadd invokes its comparator while the caller holds the root lock. The native insertion code retains raw parent and link pointers across the callback, so the verifier prohibi...

CVE-2026-98046 bpf: Mark bpf_btf_find_by_name_kind() as sleepable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

CVE-2026-98045 bpf: Mark faultable stack helpers as sleepable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark faultable stack helpers as sleepable The faultable variants of bpfgetstack and bpfgettaskstack pass mayfault=true into the common stack collection code. Resolving user-space build IDs may then call buildidparsefile and...

CVE-2026-98044 bpf: Reject legacy packet loads from callbacks

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject legacy packet loads from callbacks checkldabs models a failed BPFLDABS or BPFLDIND in a subprogram as an implicit return with R0 set to zero. It calls preparefuncexit to explore this synthesized path. When the load is...

CVE-2026-98042 bpf: Don't resurrect a scalar id dropped by collect_linked_regs()

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't resurrect a scalar id dropped by collectlinkedregs checkcondjmpop copies the compared registers into env-false,truereg1,2 before collectlinkedregs runs and copies those snapshots back into both branch states afterwards...