CVE-2026-98587 firewire: cdev: fix back-transition for iso_resource_auto client resource

In the Linux kernel, the following vulnerability has been resolved: firewire: cdev: fix back-transition for isoresourceauto client resource The todo member of isoresourceauto structure represents the state of the client resource and normally transitions in the following order: ISORESAUTOALLOC -...

EUVD-2026-103633

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

CVE-2026-98588

The Linux kernel is vulnerable to an out-of-bounds write in the sockmap component. The root cause is that sock_map_alloc() fails to reject max_entries values greater than INT_MAX, while sock_map_free() uses a signed integer iterator to traverse the sks[] array. When a SOCKMAP is created with max_...

CVE-2026-98586 sctp: hold asoc or transport before mod_timer() in timer handlers

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

CVE-2026-98586

A vulnerability exists in the Linux kernel SCTP implementation where the code calls mod_timer() before acquiring the necessary reference for a rearmed timer without holding the sock lock . This creates a race condition during timer cleanup: if a timer is deleted after mod_timer() returns but befo...

CVE-2026-98586 sctp: hold asoc or transport before mod_timer() in timer handlers

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

EUVD-2026-103631

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

CVE-2026-98585

The Linux kernel contains a vulnerability in the eth: fbnic driver related to how ring sizes are handled. The issue stems from the roundup_pow_of_two() function being undefined for zero, while ethtool allows a zero ring size to reach the driver. The fix involves leaving zero unchanged during roun...

CVE-2026-98585 eth: fbnic: Avoid rounding zero ring sizes

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

EUVD-2026-103630

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

CVE-2026-98585 eth: fbnic: Avoid rounding zero ring sizes

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

CVE-2026-98584

The Linux kernel contains a potential stack information leak within the net/sched component. The em_text_dump() function allocates struct tcf_em_text on the stack without zeroing it. Because strscpy() was used instead of strncpy(), the remaining bytes of the structure remain uninitialized. These ...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

EUVD-2026-103629

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98583

The Linux kernel contains a vulnerability in the nfc: nfcmrvl component regarding the firmware download receive path. The root cause is that the system removes the NCI data header and reads the helper command before validating the remaining packet length. This allows a short frame to reach the da...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

EUVD-2026-103628

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98582

The Linux kernel contains a vulnerability in the nfc: st21nfca component. The function st21nfca_hci_i2c_repack() incorrectly trims a received frame at its EOF marker before removing byte stuffing, leading to an out-of-bounds read. Specifically, a malformed frame can cause the unstuffing loop to r...