CVE-2026-98547

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829

The Linux kernel contains a vulnerability in the mac80211 component where oversized fragments can cause an extra_len overflow . The root cause is that entry->extra_len was narrowed from unsigned int to u16 to reduce memory footprint. When a sequence of large fragments exceeds 65535 bytes, the ...

EUVD-2026-103904

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98819

The Linux kernel contains a vulnerability in the btintel Bluetooth driver regarding how it handles DDC record lengths . The root cause is that record lengths were parsed in a manner where the value 0xFF could wrap, potentially leading to incorrect processing. The fix involves parsing lengths in u...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...

EUVD-2026-103886

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...

CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...

CVE-2026-98801

The Linux kernel contained a vulnerability where the SO_RESERVE_MEM socket option was improperly handled for UDP sockets . Because the kernel only checked for account ownership rather than protocol type, concurrent UDP packet reception and memory reservation calls could cause race conditions , le...

CVE-2026-98731

The Linux kernel contains a vulnerability in the Bluetooth btintel_pcie component within the btintel_pcie_recv_frame() function. The root cause is an integer overflow where the plen variable, defined as a u16, wraps when calculating HDR_SIZE + dlen for ACL/ISO frames if dlen is greater than or eq...

EUVD-2026-103816

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...

CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...

CVE-2026-98731 Bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: fix plen overflow in btintelpcierecvframe plen is u16 and computed as HDRSIZE + dlen. For ACL/ISO frames dlen is a 16-bit field, so a value = 0xFFFC wraps the sum, bypassing the "skb-len plen" check and...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-98634 scsi: sd_zbc: Reject disks with too many zones

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

EUVD-2026-103548

In the Linux kernel, the following vulnerability has been resolved: scsi: sdzbc: Reject disks with too many zones sdzbcreadzones computes the number of zones with 64-bit arithmetic and stores the result in the unsigned int nrzones field of struct zoneddiskinfo, silently truncating counts that...

CVE-2026-98634

The Linux kernel contains a vulnerability in the scsi: sd_zbc component where sd_zbc_read_zones() uses 64-bit arithmetic to compute zone counts but stores them in an unsigned int field. This results in silent truncation for counts exceeding 32 bits, causing the system to use incorrect values for ...