EUVD-2026-103647

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...

CVE-2026-98602 Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...

CVE-2026-98601 Bluetooth: btintel_pcie: validate device-supplied DMA indices

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

CVE-2026-98601 Bluetooth: btintel_pcie: validate device-supplied DMA indices

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

EUVD-2026-103646

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate device-supplied DMA indices In btintelpciemsixrxhandle, the driver processes RX completion descriptors urbd1 written by the PCIe device into DMA-coherent memory. urbd1-frbdtag a 16-bit field fully...

CVE-2026-98601

The Linux kernel contains a vulnerability in the btintel_pcie driver where the btintel_pcie_msix_rx_handle() function fails to validate device-supplied DMA indices. A malicious or malfunctioning device can provide an out-of-range frbd_tag (a 16-bit field), leading the driver to dereference an out...

CVE-2026-98600 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

CVE-2026-98600

The Linux kernel Bluetooth RFCOMM component contains a vulnerability in rfcomm_recv_frame() related to how it handles short EA=0 frames. When a frame with an extended 2-byte length field (requiring a 5-byte minimum) arrives as a 4-byte frame, the initial length check passes, but subsequent proces...

EUVD-2026-103645

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

STrace

STrace Steve's Tracer. A DTrace on windows syscall hook reimplementation. Think of this like a patchguard compatible SSDT hook, but without hacks. This doesn't support SSSDT win32k apis, as the DTrace system call APIs themselves do not support this additional table. Zw kernel apis can be traced i...

CVE-2026-98600 Bluetooth: RFCOMM: Reject short EA=0 frames in rfcomm_recv_frame()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Reject short EA=0 frames in rfcommrecvframe While rfcommrecvframe verifies that skb-len is at least sizeofhdr + 1 4 bytes: 3-byte header + 1-byte FCS, an RFCOMM frame with an extended 2-byte length field...

CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98598

The Linux kernel contains an IPv6 vulnerability where rt6_insert_exception() could successfully create a new exception for a dying fib6_info because the FIB6_EXCEPTION_BUCKET_FLUSHED bit was not being set correctly during certain removal sequences. This flaw creates a reference cycle between the ...

CVE-2026-98599 bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

CVE-2026-98599

The Linux kernel contains a vulnerability in the bpf subsystem specifically within stack_slot_obj_get_spi(). The issue arises because bpf_get_spi() uses C division to compute an index, which truncates toward zero; consequently, an offset of 0 produces the same index as a valid stack slot at fp-8....

EUVD-2026-103644

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

EUVD-2026-103643

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98599 bpf: Reject non-negative offsets in stack_slot_obj_get_spi()

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-negative offsets in stackslotobjgetspi bpfgetspi computes -off - 1 / BPFREGSIZE using C division, which truncates toward zero. For off == 0, this produces spi 0, the same index used by the valid stack slot at fp-8...

CVE-2026-98597

The Linux kernel contains a vulnerability in the usb: sr9700 driver. The issue occurs because the receive fixup subtracts the Ethernet CRC from the reported packet length but incorrectly compares that payload length against the entire remaining receive buffer. This discrepancy arises because the ...