CVE-2026-98613

The Linux kernel contains a vulnerability where program-allocated objects can own other local objects via referenced kptrs . The bpf_obj_free_fields() function follows these pointers synchronously through __bpf_obj_drop_impl() before RCU-based freeing. This allows self-referential local kptr type...

EUVD-2026-103658

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98612

The Linux kernel contains a vulnerability in the net: usb: catc component within the catc_rx_done() function. The root cause is an improper bound check where pkt_len > urb->actual_length ignores the header offset and compares against the entire transfer instead of the remaining bytes. This ...

CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done()

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

EUVD-2026-103657

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done()

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98611 bpf: Check params size before reading reserved fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98611 bpf: Check params size before reading reserved fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

EUVD-2026-103656

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98611

The Linux kernel contains a vulnerability in the bpf subsystem where the bpf_crypto_ctx_create() kfunc fails to properly validate the size of the second argument. Because the function reads params->reserved[0] and params->reserved[1] (offsets 14 and 15) before comparing params__sz against t...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610 net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

EUVD-2026-103655

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: bound the classify inner-filter walk with a drift budget hfscclassify applies the "filter may only point downwards" level check only when the filter result carries no bound class. A filter created with a flowi...

CVE-2026-98610

The Linux kernel contains a vulnerability in the net/sched: sch_hfsc component where the classify inner-filter walk is unbounded. When hfsc_adjust_levels() raises a class level without revalidating existing bindings, it can create a cycle between two interior classes. During classification, the s...

CVE-2026-98609

The Linux kernel contains a vulnerability in the drm/virtio component where an object leak occurs when drm_gem_handle_create() fails. The root cause is that virtio_gpu_gem_create() incorrectly calls drm_gem_object_release() instead of dropping the reference taken by virtio_gpu_object_create() . B...

CVE-2026-98609 drm/virtio: fix object leak when drm_gem_handle_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

EUVD-2026-103654

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98609 drm/virtio: fix object leak when drm_gem_handle_create() fails

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak when drmgemhandlecreate fails virtiogpugemcreate owns the reference taken by virtiogpuobjectcreate. On the drmgemhandlecreate error path it calls drmgemobjectrelease instead of dropping that reference...

CVE-2026-98608 drm/virtio: fix object leak in virtio_gpu_resource_create_ioctl()

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix object leak in virtiogpuresourcecreateioctl virtiogpuresourcecreateioctl calls drmgemobjectrelease on the drmgemhandlecreate error path instead of dropping the reference it owns, so obj-funcs-free never runs and t...