CVE-2026-98027

The Linux kernel contains a vulnerability in the net: dsa: mv88e6xxx driver. The mv88e6xxx_get_rxnfc() function incorrectly uses rxnfc->rule_cnt as a write index while dumping the policy IDR, which clobbers the input value representing the caller's buffer size. Because ETHTOOL_GRXCLSRLALL does...

CVE-2026-97992

The Linux kernel contains a use-after-free vulnerability in the vhost-vdpa component. The issue occurs because vhost_vdpa_config_cb() accesses v->config_ctx without holding a lock or taking a reference, while VHOST_VDPA_SET_CONFIG_CALL replaces the field and immediately frees the old context v...

CVE-2026-97992 vhost-vdpa: protect config_ctx from being freed under the config callback

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

CVE-2026-97983

The Linux kernel contains a vulnerability in the vduse component where the compat handler incorrectly calls the native handler for VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO commands. Because these commands have different sizes, the native dispatch returns -ENOIOCTLCMD, which overwrites the return ...

CVE-2026-97983 vduse: return compat ioctl results directly

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

EUVD-2026-86637

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

CVE-2026-97983 vduse: return compat ioctl results directly

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

CVE-2026-97983

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

EUVD-2026-86815

In the Linux kernel, the following vulnerability has been resolved: perf/core: Allow listdel during perfeventoverflow A PMU might use perfschedcbinc and perfschedcbdec interface to get the PMU call back function pmu::schedtask invoked at schedule in and schedule out. This is achieved by walking...

CVE-2026-97961

The Linux kernel contains a vulnerability in the perf/core subsystem where a list corruption can occur. The issue arises because the function perf_sched_cb_dec() may attempt to remove an entry from the sched_cb_list while that list node is still in use by perf_pmu_sched_task(). This specific path...

CVE-2026-97604 fbdev: vfb: defer cleanup until the last reference

In the Linux kernel, the following vulnerability has been resolved: fbdev: vfb: defer cleanup until the last reference FBIOGETCMAP takes a shallow snapshot of info-cmap and performs the usercopy after dropping info-lock. vfbremove frees the colormap immediately after unregistering the framebuffer...

kernel: drm/virtio: use uninterruptible resv lock for plane updates

A flaw was found in the Linux kernel's VirtIO GPU Graphics Processing Unit driver. The virtiogpucursorplaneupdate and virtiogpuresourceflush functions fail to properly acquire a required lock, which can lead to a race condition. A local user could exploit this vulnerability by triggering a memory...

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

CVE-2026-97732

The IRONMACE Ironshield 1.0.0.167 software contains a vulnerability in its tvk.sys kernel-mode driver. The root cause is that the driver authenticates client executables by searching for specific strings ("IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" ) within WIN_CERTIFICATE data instead of...

CVE-2026-97732

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

EUVD-2026-86513

IRONMACE Ironshield 1.0.0.167 has a tvk.sys kernel-mode driver that authenticates client executables by checking for expected publisher and root-certificate strings in WINCERTIFICATE data "IRONMACE Co., Ltd." and "DigiCert Trusted Root G4" instead of parsing and validating the PKCS signature data...

PT-2026-98349

Name of the Vulnerable Software and Affected Versions IRONMACE Ironshield version 1.0.0.167 Description The tvk.sys kernel-mode driver authenticates client executables by verifying expected publisher and root-certificate strings within the WIN CERTIFICATE data, specifically checking for "IRONMACE...

PT-2026-98870

Name of the Vulnerable Software and Affected Versions Google gVisor versions prior to commit 573a9e73cf844f Description An improper exposure of resource to the wrong sphere exists in the host file helper gofer on Linux platforms with CUSE Character device for Userspace enabled. A local attacker...

PT-2026-98346

Name of the Vulnerable Software and Affected Versions Argus Monitor affected versions not specified Description An exposed IOCTL allows unprivileged users to disable x86 MONITOR and MWAIT instructions used by Hyper-V and other kernel components, which triggers a HYPERVISOR ERROR bugcheck. Accessi...

CVE-2026-98027: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...