CVE-2026-98248

The Linux kernel contains a vulnerability in the arm64 architecture regarding percpu operations. Specifically, the assembly for __percpu_##name##_case_##sz() and __percpu_##name##_return_case_##sz() fails to use the 'sfx' macro argument when forming LSE instructions . This omission causes {8,16}-...

CVE-2026-98247

The Linux kernel contains a vulnerability in the Bluetooth hci_codec component. The Read Local Supported Codecs parsers incorrectly consume variable-sized standard codec arrays before parsing the vendor codec count. Because the initial reply-size check does not guarantee the vendor count byte rem...

EUVD-2026-93175

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

EUVD-2026-93176

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...

CVE-2026-98246

A use-after-free vulnerability exists in the Linux kernel Bluetooth stack within the hci_sync component. The hci_dev_close_sync() function clears the hdev->local_codecs list after releasing the hdev->lock, whereas additions and traversals in sco_sock_getsockopt() correctly acquire this lock...

EUVD-2026-93174

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

CVE-2026-98245

The Linux kernel contains a vulnerability in the btrfs filesystem. The function mark_block_group_to_copy() iterates over the commit root while skip_locking is set to true. This allows a concurrent transaction commit to swap and free the commit root during iteration, resulting in a use-after-free ...

EUVD-2026-93172

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98244

The Linux kernel btrfs filesystem contains a vulnerability where the btrfs_rebuild_free_space_tree() function fails to clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on certain error paths. Specifically, a transaction restart failure can leave this flag set on a live filesystem, which results i...

EUVD-2026-93173

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

EUVD-2026-93171

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98243

The Linux kernel contains a vulnerability in the dma-buf/dma-fence component. Specifically, a previous fix intended to prevent a NULL pointer dereference by checking the ops pointer instead of the signaled bit inadvertently caused many dma_fence implementations to lose RCU protection after signal...

EUVD-2026-93170

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98242

A vulnerability in the Linux kernel dma-buf subsystem allows for a silent overflow when the MMIO size exceeds 4G during peer-to-peer DMA through a host bridge. The root cause is that mapped_len was declared as a 32-bit unsigned int, causing a wrap-around when accumulating size_t lengths. This tru...

CVE-2026-98241

The Linux kernel contains a vulnerability where the xfrm6_local_rxpmtu() and xfrm6_local_error() functions incorrectly dereference skb->sk as a full IPv6 socket. This occurs because TCP SYN-ACK skbs may be owned by a TCP_NEW_SYN_RECV request_sock while the output path is driven by a full liste...

CVE-2026-98240

The Linux kernel contains a vulnerability in the net: ip_tunnel component where options_len is used to calculate an option pointer before being initialized. This oversight leads to a buffer overflow during a memcpy operation, specifically when processing geneve_opts . This issue can trigger a ker...

CVE-2026-98241

In the Linux kernel, the following vulnerability has been resolved: i...

EUVD-2026-93169

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

EUVD-2026-93168

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

EUVD-2026-93167

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...