CVE-2026-98262

The Linux kernel libahci driver contains a functional issue where the JMicron JMB585 becomes unusable when the AHCI_HFLAG_32BIT_ONLY flag is used. The root cause is that for HBAs supporting 64-bit addressing, the PxCLBU and PxFBU registers have implementation-specific reset values; however, when ...

EUVD-2026-93191

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt712-sdca-dmic: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98263

The Linux kernel contains a vulnerability in the ASoC: codecs: rt712-sdca-dmic component. The root cause is that the stream_config structure is not initialized before being passed to sdw_stream_add_slave() , allowing the type field to contain garbage values. This uninitialized data is subsequentl...

CVE-2026-98261

The Linux kernel contains a use-after-free vulnerability within the cifs component, specifically in the cifs_chan_skip_or_disable() function. The issue occurs when a secondary channel is no longer supported by the server; the function drops the channel reference via cifs_put_tcp_session() but con...

EUVD-2026-93189

In the Linux kernel, the following vulnerability has been resolved: cifs: Fix server use-after-free in cifschanskipordisable When a secondary channel is no longer supported by the server, cifschanskipordisable drops the channel reference with cifsputtcpsession and then continues to use the server...

CVE-2026-98260

The Linux kernel is vulnerable to a use-after-free condition during the execve() system call. When a non-leader thread executes, de_thread() reassigns the PID to a leader thread, but the per-thread CPU timer node remains queued on the original thread. If subsequent operations like exec_mmap() fai...

CVE-2026-98259

The Linux kernel is vulnerable to a kernel panic when booting a VM with DAX enabled storage . The issue is caused by calling dax_to_folio() with an empty entry , which occurs in the fs/dax component. Specifically, the vulnerability persists in dax_associate_entry(), dax_disassociate_entry(), and ...

EUVD-2026-93188

In the Linux kernel, the following vulnerability has been resolved: exec: Cleanup POSIX timers right after dethread A per-thread CPU timer holds a reference to the PID of the thread it is attached to and, while it is armed, its node is queued in that thread's posixcputimers. The task is looked up...

EUVD-2026-93187

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98258

The Linux kernel contains a race condition in the posix-cpu-timers code. The issue stems from the cpu_timer::firing bit being converted to a boolean, which fails to distinguish between a timer not being owned by the firing list and one whose delivery was canceled. This allows a race between the e...

EUVD-2026-93186

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

CVE-2026-98257

The Linux kernel contains a vulnerability in the RDS (Reliable Datagram Sockets) over InfiniBand (ib) implementation. Specifically, the rds_ib_cm_connect_complete() function incorrectly calls rds_conn_destroy() when a peer negotiates an older protocol version while holding the conn->c_cm_lock....

CVE-2026-98256

The Linux kernel contains a use-after-free vulnerability in the signal handling mechanism, specifically during an exec() call by a non-leader thread. The issue arises because posixtimer_send_sigqueue() performs a non-atomic check on the task::pending signal queue. If a timer signal is blocked and...

EUVD-2026-93185

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

EUVD-2026-93184

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

CVE-2026-98255

The Linux kernel contains a vulnerability where old Acknowledgements (ACKs) could bypass the fast path of the TCP stack. Specifically, ACKs before SND.UNA and after SND.NXT were not being properly validated, potentially allowing them to modify connection state or advance RCV.NXT prematurely. The ...

EUVD-2026-93183

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcpack performs the appropriate validation and...

CVE-2026-98253

The Linux kernel contains a vulnerability in the RDMA/ucma component where a race condition occurs during multicast join and leave operations. Specifically, if copy_to_user() fails during ucma_process_join(), the ctx->mutex is dropped prematurely, potentially allowing concurrent JOIN_MCAST cal...

EUVD-2026-93182

In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlbbounce reads the page frame number from the slot's recorded origaddr, then advances origaddr by tlboffset to reach the address the caller asked about. The highm...

CVE-2026-98254

A vulnerability exists in the Linux kernel 's swiotlb component. The swiotlb_bounce() function incorrectly handles highmem page lookups by mixing the offset from an adjusted address with a page frame number from an unadjusted address. When a tlb_offset crosses a page boundary, data is written to ...