CVE-2026-98749 tty: serial: max3100: shut down timer before freeing port

In the Linux kernel, the following vulnerability has been resolved: tty: serial: max3100: shut down timer before freeing port max3100shutdown stops the polling timer but returns early during system suspend. If the SPI device is unbound before resume, the serial core does not call max3100shutdown...

CVE-2026-98748 serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

EUVD-2026-103833

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

CVE-2026-98748

The Linux kernel contains a use-after-free vulnerability in the brcmuart_remove() function associated with the 8250_bcm7271 serial driver. The root cause occurs when a receive-timeout interrupt arrives between the cancellation of the high-resolution timer (hrtimer) and the unregistering of the po...

CVE-2026-98748 serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

CVE-2026-98747 serial: core: fix NULL pointer dereference in serial_core_unregister_port()

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

EUVD-2026-103832

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

CVE-2026-98747

The Linux kernel contains a NULL pointer dereference vulnerability in the serial_core_unregister_port() function. The issue occurs because port->port_dev is NULL when no port device is installed—either because it was cleared during teardown or never set due to a registration failure in serial_...

CVE-2026-98747 serial: core: fix NULL pointer dereference in serial_core_unregister_port()

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

EUVD-2026-103831

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe never does that, so the reference is leaked on the probe error paths a...

CVE-2026-98746

The Linux kernel contains a clock reference leak within the ma35d1 serial driver. Specifically, the ma35d1serial_probe() function fails to call clk_put() to release the reference returned by of_clk_get(). This results in a memory leak during probe error paths and upon port removal. The fix involv...

CVE-2026-98746 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe never does that, so the reference is leaked on the probe error paths a...

CVE-2026-98746 serial: ma35d1: Fix clock reference leak in ma35d1serial_probe()

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe never does that, so the reference is leaked on the probe error paths a...

CVE-2026-98745 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...

EUVD-2026-103830

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...

CVE-2026-98745 arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...

CVE-2026-98745

The Linux kernel contains a vulnerability where restoring a specifically crafted SVE signal context on systems supporting SME but not SVE can result in a task erroneously holding non-streaming SVE state. This occurs because restore_sve_fpsimd_context() fails to reject cases where SVE_SIG_FLAG_SM ...

EUVD-2026-103829

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98744

In the Linux kernel , a vulnerability exists within the ASoC: codecs: max98363 driver. The stream_config structure is not properly initialized before being passed to the sdw_stream_add_slave() function. This allows the type field to contain garbage data, which is subsequently copied to stream-&gt...

CVE-2026-98744 ASoC: codecs: max98363: fix uninitialized stream_config->type

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...