CVE-2026-98273

In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the hrtimerrunqueues function: : nopl...

CVE-2026-98325

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98289

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

CVE-2026-98286

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98220

In the Linux kernel, the following vulnerability has been resolved: schedext: Fix NULL sched deref in kfunc sub-sched error paths When the root scheduler has sub-scheds attached, the COMPAT kfunc wrappers scxbpfselectcpuand and scxbpfdsqinsertvtime refuse the call and report to @p's scheduler:...

CVE-2026-98215

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve user SID across nested backing files SELinux saves the user file SID in a backing-file security blob so it remains available after mmap replaces vma-vmfile with a backing file. For nested backing files overlayfs...

CVE-2026-98231

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrmdevstateflush finds states under xfrmstatedevgclock, but drops the lock before calling xfrmdevstatefree because the driver callback may sleep. The...

CVE-2026-98221

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...

CVE-2026-98224

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98259

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98205

In the Linux kernel, the following vulnerability has been resolved: Input: evdev - zero absinfo before partial copy in EVIOCSABS The EVIOCSABS handler copies at most the user supplied ioctl size into an uninitialized on-stack struct inputabsinfo: if copyfromuser&abs, p, mintsizet, size,...

CVE-2026-98212

In the Linux kernel, the following vulnerability has been resolved: mmc: hsq: Fix use-after-free in retry work mmchsqpumprequests queues retrywork when requestatomic returns -EBUSY; today sdhci-sprd is the only consumer that implements requestatomic. The work is embedded in a devm-allocated mmchs...

CVE-2026-98247

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98248

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...

CVE-2026-98250

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

UBUNTU-CVE-2026-98272

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

UBUNTU-CVE-2026-98308

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98362

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

CVE-2026-98356

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: check createsinglethreadworkqueue in DCB setup bnxtreinitdcbwq ignores a failed allocation. The async DCB handler later calls queuework on the NULL pointer...

CVE-2026-98363

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...