CVE-2026-98611

The Linux kernel contains a vulnerability in the bpf subsystem where the bpf_crypto_ctx_create() kfunc fails to properly validate the size of the second argument. Because the function reads params->reserved[0] and params->reserved[1] (offsets 14 and 15) before comparing params__sz against t...

CVE-2026-98611 bpf: Check params size before reading reserved fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98611 bpf: Check params size before reading reserved fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

EUVD-2026-103656

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610

The Linux kernel contains a vulnerability in the net/sched: sch_hfsc component where the classify inner-filter walk is unbounded. When hfsc_adjust_levels() raises a class level without revalidating existing bindings, it can create a cycle between two interior classes. During classification, the s...

EUVD-2026-103655

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

EUVD-2026-103654

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98609 drm/virtio: fix object leak when drm_gem_handle_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98609 drm/virtio: fix object leak when drm_gem_handle_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98609

The Linux kernel contains a vulnerability in the drm/virtio component where an object leak occurs when drm_gem_handle_create() fails. The root cause is that virtio_gpu_gem_create() incorrectly calls drm_gem_object_release() instead of dropping the reference taken by virtio_gpu_object_create() . B...

EUVD-2026-103653

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

CVE-2026-98608

The Linux kernel contains a vulnerability in the drm/virtio component where the virtio_gpu_resource_create_ioctl() function causes an object leak . Specifically, during the drm_gem_handle_create() error path, the code incorrectly calls drm_gem_object_release() instead of dropping the owned refere...

CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

CVE-2026-98607 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

CVE-2026-98607 drm/virtio: fix object leaks in virtio_gpu_resource_create_blob_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

CVE-2026-98607

The Linux kernel contains an object leak vulnerability within the drm/virtio component, specifically inside the virtio_gpu_resource_create_blob_ioctl() function. The root cause is that the function calls drm_gem_object_release() on error paths for both virtio_gpu_resource_assign_uuid() and drm_ge...