CVE-2026-98586 sctp: hold asoc or transport before mod_timer() in timer handlers

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

CVE-2026-98586

A vulnerability exists in the Linux kernel SCTP implementation where the code calls mod_timer() before acquiring the necessary reference for a rearmed timer without holding the sock lock . This creates a race condition during timer cleanup: if a timer is deleted after mod_timer() returns but befo...

CVE-2026-98586 sctp: hold asoc or transport before mod_timer() in timer handlers

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

EUVD-2026-103631

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

CVE-2026-98585

The Linux kernel contains a vulnerability in the eth: fbnic driver related to how ring sizes are handled. The issue stems from the roundup_pow_of_two() function being undefined for zero, while ethtool allows a zero ring size to reach the driver. The fix involves leaving zero unchanged during roun...

CVE-2026-98585 eth: fbnic: Avoid rounding zero ring sizes

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

EUVD-2026-103630

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

CVE-2026-98585 eth: fbnic: Avoid rounding zero ring sizes

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Avoid rounding zero ring sizes rounduppowoftwo is undefined for zero. ethtool permits a zero ring size to reach the driver, where the minimum-size check should reject it. Leave zero unchanged while rounding nonzero ri...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

EUVD-2026-103629

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98584

The Linux kernel contains a potential stack information leak within the net/sched component. The em_text_dump() function allocates struct tcf_em_text on the stack without zeroing it. Because strscpy() was used instead of strncpy(), the remaining bytes of the structure remain uninitialized. These ...

CVE-2026-98583

The Linux kernel contains a vulnerability in the nfc: nfcmrvl component regarding the firmware download receive path. The root cause is that the system removes the NCI data header and reads the helper command before validating the remaining packet length. This allows a short frame to reach the da...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98583 nfc: nfcmrvl: validate helper command length before pull

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

EUVD-2026-103628

In the Linux kernel, the following vulnerability has been resolved: nfc: nfcmrvl: validate helper command length before pull The firmware download receive path removes the NCI data header and reads the helper command before validating the remaining packet length. A short frame can therefore reach...

CVE-2026-98582

The Linux kernel contains a vulnerability in the nfc: st21nfca component. The function st21nfca_hci_i2c_repack() incorrectly trims a received frame at its EOF marker before removing byte stuffing, leading to an out-of-bounds read. Specifically, a malformed frame can cause the unstuffing loop to r...

CVE-2026-98582 nfc: st21nfca: validate received frame size

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

CVE-2026-98582 nfc: st21nfca: validate received frame size

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...

EUVD-2026-103627

In the Linux kernel, the following vulnerability has been resolved: nfc: st21nfca: validate received frame size st21nfcahcii2crepack trims a received frame at its EOF marker before removing byte stuffing. It then assumes the truncated frame contains the LLC header and two CRC bytes, and it...