CVE-2026-98613

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98615

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts th...

CVE-2026-98617

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-numnapi; The issue is this is only correct in the cases where there are...

CVE-2026-98612

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98616

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset numnapi when the napi vectors are freed fbn-numnapi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnicpmsuspend tears the datapath down via...

CVE-2026-98619

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

AZL-109049 CVE-2026-98608 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

AZL-109227 CVE-2026-98610 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

AZL-108605 CVE-2026-98607 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

AZL-109370 CVE-2026-98609 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98603

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

CVE-2026-98606

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: release the GEM object on virtiogpuvramcreate errors virtiogpuvramcreate frees the object with a bare kfreevram on both error paths after drmgemprivateobjectinit has run, and on the second one after...

CVE-2026-98604

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

CVE-2026-98605

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98608

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...

CVE-2026-98610

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98609

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98607

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leaks in virtiogpuresourcecreateblobioctl virtiogpuresourcecreateblobioctl calls drmgemobjectrelease on both the virtiogpuresourceassignuuid and drmgemhandlecreate error paths instead of dropping the...

CVE-2026-98611

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

AZL-108836 CVE-2026-98602 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bnep: fix out-of-bounds reads on short RX/TX frames and control fallthrough Fix multiple out-of-bounds reads in Bluetooth BNEP frame processing: 1. In bneprxframe and bnepctrlframe net/bluetooth/bnep/core.c, use...