CVE-2026-98332

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: only operate on TDLS peers in the TDLS code ieee80211tdlsoper can operate on the AP station, which then yields various warnings when the AP station is removed then or at a later point in time after being confused...

CVE-2026-98329

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't allow injecting frames wider than the chanctx Frames injected on a monitor interface can carry a radiotap field requesting a bandwidth, which mac80211 passes down to the driver regardless of the the actual...

CVE-2026-98371

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98372

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98343

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

CVE-2026-98280

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xei2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xei2cremove a...

CVE-2026-98274

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

CVE-2026-98273

In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the hrtimerrunqueues function: : nopl...

CVE-2026-98340

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: only group hidden BSSes with beacon entries When a probe response for an unknown BSS comes in, cfg80211bssupdate looks for an existing entry with the same BSSID and a hidden zero-length or NUL-filled SSID, and if ...

CVE-2026-98325

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98289

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98337

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

CVE-2026-98220

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scxbpfselectcpuand and scxbpfdsqinsertvtime refuse the call and report to @p's scheduler:...

CVE-2026-98215

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap replaces vma-vmfile with a backing file. For nested backing files overlayfs...

CVE-2026-98231

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrmdevstateflush finds states under xfrmstatedevgclock, but drops the lock before calling xfrmdevstatefree because the driver callback may sleep. The...

CVE-2026-98221

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

CVE-2026-98224

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98259

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98255

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcpack performs the appropriate validation and...