CVE-2026-98224

The Linux kernel contains a memory accounting flaw in the mm/vma component. When call_mmap_prepare() fails, the system incorrectly jumps to abort_munmap without properly uncounting memory that was previously accounted for during __mmap_setup() via vm_acct_memory() . This could lead to inaccurate ...

EUVD-2026-93152

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98223

The Linux kernel contains a vulnerability where Fault-around can map ready dropbehind folios without undergoing the standard page-cache lookup. Because a mapping represents a competing cached user, the system should retain the folio rather than forcibly unmapping it upon writeback completion. If ...

EUVD-2026-93151

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

EUVD-2026-93150

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222

The Linux kernel contains an integer overflow vulnerability in the KEYS: encrypted subsystem. The function encrypted_key_alloc() stores datablob_len in a u16 variable. When the sum of various string and payload lengths exceeds U16_MAX , the allocation size is truncated, leading to a slab-out-of-b...

CVE-2026-98221

A vulnerability exists in the Linux kernel related to the tpm2_load_cmd() function. The issue is caused by the function performing boundary checks against the ASN.1 size (specifically payload->blob_len) instead of the correct size. The fix involves passing the decoded blob size to tpm2_load_cm...

EUVD-2026-93149

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

CVE-2026-98220

The Linux kernel contains a vulnerability in the sched_ext framework where the COMPAT kfunc wrappers scx_bpf_select_cpu_and() and scx_bpf_dsq_insert_vtime() cause a NULL pointer dereference when processing tasks with no scheduler. Specifically, these wrappers attempt to report errors to a non-exi...

EUVD-2026-93148

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scxbpfselectcpuand and scxbpfdsqinsertvtime refuse the call and report to @p's scheduler:...

CVE-2026-98219

The Linux kernel contains a vulnerability in the sched_ext component where a race condition exists during the transition to the SCX_ENABLING state. Specifically, the scx_alloc_and_add_sched() function publishes ops->priv before scx_root_enable_workfn() switches the state. An error claimed via ...

CVE-2026-98218

The Linux kernel contains a vulnerability where the function i2c_atr_add_adapter() stores a pointer to atr->adapter[chan_id] before calling i2c_add_adapter(). If i2c_add_adapter() fails, the channel is freed, but the slot remains pointing at the freed memory . This situation can result in a us...

EUVD-2026-93147

In the Linux kernel, the following vulnerability has been resolved: schedext: Close the pre-enable ops error claim window scxallocandaddsched publishes ops-priv before scxrootenableworkfn switches the state to SCXENABLING. An error claimed via scxbpferrorbstr from an associated BPF program in tha...

EUVD-2026-93146

In the Linux kernel, the following vulnerability has been resolved: i2c: atr: fix dangling adapter pointer on add failure i2catraddadapter stores atr-adapterchanid before i2caddadapter so that the I2C bus notifier can match child clients during registration. On failure the channel is freed but th...

CVE-2026-98217

The Linux kernel contains a use-after-free vulnerability in the IB/mlx4 driver during pkey sysfs registration . The root cause is that the register_pkey_tree() function ignores errors from register_one_pkey_tree() and continues registering remaining slaves. While the error path releases the pkey ...

EUVD-2026-93145

In the Linux kernel, the following vulnerability has been resolved: IB/mlx4: Fix use-after-free on pkey sysfs registration failure registerpkeytree ignores errors from registeronepkeytree and continues registering the remaining slaves. The per-slave error path has already released the pkey parent...

CVE-2026-98216

The Linux kernel contains a vulnerability in the hfi1 driver's hfi1_file_mmap() function. The issue stems from incorrect pointer arithmetic where a byte offset is added to a struct pointer, causing memvirt to land outside the allocated memory. When an IOMMU is active, this results in remap_pfn_ra...

EUVD-2026-93144

In the Linux kernel, the following vulnerability has been resolved: IB/hfi1: Fix the PIOCRED credit-return mmap hfi1filemmap's PIOCRED case must hand user space the single credit-return page that holds this context's entry. That page is the second or third page of the per-node credit-return...

EUVD-2026-93143

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap replaces vma-vmfile with a backing file. For nested backing files overlayfs...

CVE-2026-98215

The Linux kernel contains a vulnerability in SELinux related to how user file SIDs are preserved across nested backing files, such as overlayfs over overlayfs or FUSE passthrough . When mmap() replaces vma->vm_file with a backing file, the system may incorrectly use the SID of the mounter inst...