CVE-2026-98230

The Linux kernel contains a vulnerability in the xfrm component related to how state_cache and state_cache_input lists are handled during deletion. The root cause is the use of hlist_del_rcu() instead of hlist_del_init_rcu(). Because hlist_del_rcu() leaves a non-NULL pprev value, a second call to...

EUVD-2026-93158

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlistdelinitrcu for statecache and statecacheinput Commit 14acf9652e56 "xfrm: defensively unhash xfrmstate lists in xfrmstatedelete" converted bydst/bysrc/byseq/byspi from hlistdelrcu to hlistdelinitrcu so that a second...

CVE-2026-98228

The Linux kernel is affected by a memory ordering issue on MIPS I6500 CPU cores . The lld and scd instructions provide no ordering guarantees, which can lead to a failure to respect the assumed full ordering of arch_cmpxchg() . This lack of synchronization can cause system instability, such as ke...

EUVD-2026-93157

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrminput stores the current xfrmstate in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrminput has finished...

EUVD-2026-93156

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98229

The Linux kernel contains a vulnerability where xfrm_input() can dereference a freed state. The issue occurs because some input paths, such as VTI and XFRM interfaces , can reset the secpath before xfrm_input() finishes processing. Specifically, if secpath_reset() drops the last state reference w...

CVE-2026-98227

The Linux kernel contains a memory leak vulnerability in the memstick driver. The msb_init_disk() function allocates a per-card ordered workqueue using alloc_ordered_workqueue(), but the workqueue is only destroyed on error paths. Because msb_remove() fails to destroy the workqueue and other clea...

EUVD-2026-93155

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: destroy ioqueue workqueue on removal msbinitdisk creates the per-card ordered workqueue msb-ioqueue with allocorderedworkqueue. It is torn down with destroyworkqueue only on the init error path; msbremove never...

CVE-2026-98226

The Linux kernel contains a vulnerability where the SWAP_USAGE_OFFLIST_BIT collides with the real usage count because it is defined as bit 30 of an atomic_t type. On systems with 4 KiB pages, this collision occurs once the count reaches 4 TiB . This leads to several issues: /proc/swaps understate...

EUVD-2026-93154

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

CVE-2026-98225

The Linux kernel contains a vulnerability in the mm/shrinker component related to the cgroup.memory=nokmem configuration. When nokmem is active, shrinker_memcg_alloc() bails out early, causing shrinker->id to retain a default value of 0 from kzalloc(). This value is then incorrectly treated as...

EUVD-2026-93153

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus setshrinkerbit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinkermemcgalloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinkeralloc...

CVE-2026-98224

The Linux kernel contains a memory accounting flaw in the mm/vma component. When call_mmap_prepare() fails, the system incorrectly jumps to abort_munmap without properly uncounting memory that was previously accounted for during __mmap_setup() via vm_acct_memory() . This could lead to inaccurate ...

EUVD-2026-93152

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98223

The Linux kernel contains a vulnerability where Fault-around can map ready dropbehind folios without undergoing the standard page-cache lookup. Because a mapping represents a competing cached user, the system should retain the folio rather than forcibly unmapping it upon writeback completion. If ...

EUVD-2026-93151

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

EUVD-2026-93150

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222

The Linux kernel contains an integer overflow vulnerability in the KEYS: encrypted subsystem. The function encrypted_key_alloc() stores datablob_len in a u16 variable. When the sum of various string and payload lengths exceeds U16_MAX , the allocation size is truncated, leading to a slab-out-of-b...

CVE-2026-98221

A vulnerability exists in the Linux kernel related to the tpm2_load_cmd() function. The issue is caused by the function performing boundary checks against the ASN.1 size (specifically payload->blob_len) instead of the correct size. The fix involves passing the decoded blob size to tpm2_load_cm...

EUVD-2026-93149

In the Linux kernel, the following vulnerability has been resolved: KEYS: trusted: Fix tpm2loadcmd boundary check tpm2loadcmd does boundary checks against the ASN.1 size i.e., payload-bloblen. Address this by passing the decoded blob size to tpm2loadcmd, and use it for the boundary checks...