EUVD-2026-93186

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

CVE-2026-98257

The Linux kernel contains a vulnerability in the RDS (Reliable Datagram Sockets) over InfiniBand (ib) implementation. Specifically, the rds_ib_cm_connect_complete() function incorrectly calls rds_conn_destroy() when a peer negotiates an older protocol version while holding the conn->c_cm_lock....

CVE-2026-98256

The Linux kernel contains a use-after-free vulnerability in the signal handling mechanism, specifically during an exec() call by a non-leader thread. The issue arises because posixtimer_send_sigqueue() performs a non-atomic check on the task::pending signal queue. If a timer signal is blocked and...

EUVD-2026-93185

In the Linux kernel, the following vulnerability has been resolved: rds: ib: use rdsconndrop on protocol version mismatch rdsibcmconnectcomplete runs from the RDMA-CM event handler with conn-ccmlock held. When the peer negotiates a protocol version older than RDSPROTOCOLCOMPATVERSION, the handler...

EUVD-2026-93184

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

CVE-2026-98255

The Linux kernel contains a vulnerability where old Acknowledgements (ACKs) could bypass the fast path of the TCP stack. Specifically, ACKs before SND.UNA and after SND.NXT were not being properly validated, potentially allowing them to modify connection state or advance RCV.NXT prematurely. The ...

EUVD-2026-93183

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcpack performs the appropriate validation and...

CVE-2026-98253

The Linux kernel contains a vulnerability in the RDMA/ucma component where a race condition occurs during multicast join and leave operations. Specifically, if copy_to_user() fails during ucma_process_join(), the ctx->mutex is dropped prematurely, potentially allowing concurrent JOIN_MCAST cal...

EUVD-2026-93182

In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlbbounce reads the page frame number from the slot's recorded origaddr, then advances origaddr by tlboffset to reach the address the caller asked about. The highm...

CVE-2026-98254

A vulnerability exists in the Linux kernel 's swiotlb component. The swiotlb_bounce() function incorrectly handles highmem page lookups by mixing the offset from an adjusted address with a page frame number from an unadjusted address. When a tlb_offset crosses a page boundary, data is written to ...

EUVD-2026-93181

In the Linux kernel, the following vulnerability has been resolved: RDMA/ucma: Serialize join and leave on copytouser failure rdmajoinmulticast queues RoCE work that later reads the ucmamulticast through event-param.ud.privatedata, then listadds the CMA multicast at the head of idpriv-mclist...

CVE-2026-98252

The Linux kernel contains a reference count bug within the RDMA/core component, specifically in the iwpm_get_nlmsg_request() function. The root cause is that the refcount is initialized after the list_add_tail() operation, allowing another CPU to perform a kref_get() on a global list before initi...

EUVD-2026-93180

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

CVE-2026-98251

The Linux kernel contains a vulnerability in openvswitch related to how conntrack labels are handled. The function ovs_ct_get_conn_labels() previously added labels to conntrack entries that lacked them. Because confirmed conntracks can be read locklessly, adding an extension could trigger a reall...

CVE-2026-98250

The Linux kernel contains a vulnerability in nfsd related to the handling of NFSEXP_PNFS within the netlink codepath . The issue arose because a previous rework of block layout checks moved the NFSEXP_PNFS check out of nfsd4_setup_layout_type() into its callers, but that patch failed to account f...

EUVD-2026-93179

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

EUVD-2026-93178

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

CVE-2026-98249

The Linux kernel contains a vulnerability in the arm64 architecture during hibernation. The function swsusp_arch_suspend_exit() fails to pass the required arguments for HVC_SET_VECTORS when reinstalling the restored kernel's hyp stub vectors. Because x0 and x1 registers are not correctly set, the...

EUVD-2026-93177

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

CVE-2026-98247

The Linux kernel contains a vulnerability in the Bluetooth hci_codec component. The Read Local Supported Codecs parsers incorrectly consume variable-sized standard codec arrays before parsing the vendor codec count. Because the initial reply-size check does not guarantee the vendor count byte rem...