CVE-2026-98328

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: add HE 6 GHz capability in the scan elems len The HE 6 GHz Band Capability element is in the probe request for every band if 6 GHz is supported, so add the size to scanieslen. Otherwise, building probe request...

CVE-2026-98320

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

CVE-2026-98316

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98233

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

CVE-2026-98197

In the Linux kernel, the following vulnerability has been resolved: hwmon: w83791d remove fan/pwm 4-5 sysfs group on remove When the fan/pwm 4-5 pins are not used as GPIO, w83791dprobe creates the w83791dgroupfanpwm45 sysfs group on the I2C client device. The probe error path removes this group...

CVE-2026-98207

In the Linux kernel, the following vulnerability has been resolved: mmc: spi: reset bytesxfered before retrying CRC failures mmcspidatado updates data-bytesxfered after each block has been transferred successfully. If a later block in the same data request fails with a CRC error, data-bytesxfered...

CVE-2026-98181

In the Linux kernel, the following vulnerability has been resolved: drm/gud: fix out-of-bounds write in gudplaneatomiccheck The plane property loop uses req-propertiesnumproperties + i as write index while simultaneously incrementing numproperties inside the loop. At iteration i, numproperties ha...

CVE-2026-98303

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98252

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

CVE-2026-98194

In the Linux kernel, the following vulnerability has been resolved: wifi: libertastf: fix UAF in lbtffreeadapter lbtffreeadapter calls lbtffreecmdbuffer to free the command buffers before calling timerdeletesync to wait for the command timer callback. If the timer callback commandtimerfn is alrea...

CVE-2026-98191

In the Linux kernel, the following vulnerability has been resolved: wifi: wlcore: release runtime PM ref on regdomain config failure wlcoreregdomainconfig gets a runtime PM reference before sending the regulatory-domain command. When wlcorecmdregdomainconfiglocked fails, the function queues...

CVE-2026-98228

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98327

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

CVE-2026-98185

In the Linux kernel, the following vulnerability has been resolved: wifi: mwifiex: validate scan response extents mwifiexret80211scan subtracts the fixed response fields and the firmware-provided BSS length from resp-size without first proving that either extent fits. A short response or oversize...

CVE-2026-98225

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus setshrinkerbit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinkermemcgalloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinkeralloc...

CVE-2026-98298

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98276

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98244

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98230

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlistdelinitrcu for statecache and statecacheinput Commit 14acf9652e56 "xfrm: defensively unhash xfrmstate lists in xfrmstatedelete" converted bydst/bysrc/byseq/byspi from hlistdelrcu to hlistdelinitrcu so that a second...