CVE-2026-98937

The Linux kernel contains a vulnerability where the perf_event_open() system call fails to properly enforce permission checks. Specifically, it only gates perf_allow_kernel() when attr.exclude_kernel is false. This allows users to request kernel callchain collection (where attr.exclude_callchain_...

EUVD-2026-108909

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users can still request kernel callchain collection with...

EUVD-2026-108908

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-98936

The Linux kernel contains a vulnerability in the ath11k wireless driver where the num_stations variable in struct ath11k is not properly reset during multiple hardware restarts. This oversight in ath11k_mac_op_start() causes the driver to incorrectly believe the maximum station limit (128) is rea...

EUVD-2026-108907

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98935

The Linux kernel is affected by an information leak vulnerability within the RTC (Real Time Clock) subsystem. Specifically, the struct rtc_wkalrm contains padding holes following the 'pending' member. When this structure is returned to userspace via the RTC_WKALRM_RD ioctl , uninitialized kernel ...

CVE-2026-98934

The Linux kernel contains a vulnerability where the seg6_make_flowlabel() function could be reached with a socket buffer (skb ) lacking both skb->dev and skb->sk pointers. This issue occurs when a TIPC UDP bearer sends a discovery message via an IPv4 route using seg6 encap while net.ipv6.se...

EUVD-2026-108906

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

EUVD-2026-108905

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-98933

The Linux kernel contains a vulnerability where holding a USB3 hub PM runtime reference for 200ms during hub resume triggers issues on AMD platforms . This specifically causes crashes for users running Android adb after the subsystem has been polled and woken periodically. The root cause is ident...

EUVD-2026-108904

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98932

The Linux kernel contains a use-after-free vulnerability in the EDAC/altera component. Specifically, within the altr_edac_a10_device_add() and altr_portb_setup() functions, the error path incorrectly freed the dci structure before releasing the devres group . This creates a race condition where a...

CVE-2026-98931

The Linux kernel contains a vulnerability in the mtd: spinand component where a NULL pointer dereference occurs when the "nand-no-ecc-engine" property is set in the Device Tree. Specifically, nanddev_get_ecc_engine() returns success while leaving nand->ecc.engine as NULL, but the SPI-NAND code...

EUVD-2026-108903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

EUVD-2026-108901

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When injectsigpstop is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread...

EUVD-2026-108899

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsgifinfobuildskb when IPv4 forwarding is enabled by default...

CVE-2026-98929

The Linux kernel contains a vulnerability in the macsec driver where the SecY is initialized after the netdevice is registered. When creating a MACsec device with MAC offload over an LRO-capable lower device, register_netdevice() triggers a NETDEV_FEAT_CHANGE notification before macsec_add_dev() ...

EUVD-2026-108898

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUESTHASSVE from the SVE feature bit at EL2 pkvminitfeaturesfromhost takes KVMARCHFLAGGUESTHASSVE and KVMARMVCPUSVE from the host separately, but pkvmvcpuinitsve tests the bit while vcpuhassve reads the flag. A...

cve-2018-17182

define GNUSOURCE include include include include include include include include include include include int vmaspamcontrolfd = -1; int threaddonefd = -1; int vmaspamdonefd = -1; void semincint fd uint64t val = 1; if writefd, &val, 8 != 8 err1, "seminc"; void semdecint fd uint64t val; if readfd,...

CVE-2026-98927

The Linux kernel contains a vulnerability in KVM for arm64 architectures related to the nested_mmus array life cycle. The array holds shadow page tables used when a guest runs a nested context. A race condition exists where a VCPU_INIT event could trigger a reallocation of the array while a vcpu ...