CVE-2026-98353

The Linux kernel contains a vulnerability in the RDMA/erdma subsystem where locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. This occurs because if an interrupt arrives while the create path holds a plain xa_lock , the lookup operation spins indefinitely a...

EUVD-2026-93336

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: free skb when disconnected When the simulated link is disconnected, virtwifistartxmit returns NETXMITDROP without freeing the skb. devhardstartxmit treats this return value as consumed, so every packet sent while...

CVE-2026-98351

The Linux kernel contains a memory leak vulnerability in the virt_wifi component. When a simulated link is disconnected, the virt_wifi_start_xmit() function returns NET_XMIT_DROP without freeing the skb . Because dev_hard_start_xmit() treats this return value as consumed, every packet sent while ...

CVE-2026-98350

The Linux kernel contains a vulnerability in the wifi: brcmfmac: cyw component. The root cause is a failure to zero out auth_status during initialization, which allows garbage data to leak from the stack to the firmware. This occurs specifically when the ssid is shorter than 32 bytes and/or when ...

EUVD-2026-93335

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: cyw: pass PMKID to firmware if present Zero out authstatus on initialization. Otherwise, garbage will leak from the stack to the firmware when ssid is less than 32 bytes and/or when params-pmkid is set. Then, pass...

CVE-2026-98349

The Linux kernel contains a vulnerability in the libipw component where libipw_network_init() and libipw_process_probe_response() fail to properly validate the length of beacon and probe responses. The issue stems from an integer underflow : because stats->len is a u16 and sizeof() is a size_t...

EUVD-2026-93334

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

CVE-2026-98347

The Linux kernel contains a race condition in the IB/IPoIB driver where ipoib_ib_dev_flush_light() restores the IPOIB_FLAG_OPER_UP flag after a multicast flush. This restore can conflict with ipoib_ib_dev_down(), potentially leaving the flag set after the device is down. Consequently, ipoib_mcast...

EUVD-2026-93333

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

EUVD-2026-93332

In the Linux kernel, the following vulnerability has been resolved: IB/IPoIB: Avoid restoring OPERUP after multicast flush ipoibibdevflushlight temporarily clears IPOIBFLAGOPERUP to prevent multicast joins while ipoibmcastdevflush is running, and restores the flag afterwards if it was previously...

CVE-2026-98348

The Linux kernel contains a vulnerability in the libipw component where the ipw2100 and ipw2200 management receive paths fail to properly validate the length of association responses. Specifically, the function libipw_handle_assoc_resp() performs an unsafe subtraction between a u16 length and a s...

CVE-2026-98346

The Linux kernel contains a vulnerability in the cfg80211 component where the function cfg80211_calculate_bi_data() calls rdev_get_radio_mask() using wdev->netdev. Because wdev->netdev can be NULL for certain network device types, this leads to a crash in mac80211 . The fix involves inverti...

EUVD-2026-93331

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

EUVD-2026-93330

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98345

The Linux kernel contains a vulnerability within the cfg80211 component, specifically in the cfg80211_classify8021d() function. The issue occurs when a frame mimicking an IP packet is transmitted but is too short, causing the DS field to be read incorrectly. This leads to an uninit-value error as...

CVE-2026-98344

The Linux kernel contains a vulnerability in the dmaengine component involving a device kref underflow in dma_chan_put(). The issue occurs because dma_chan_get() only increments the chan->device->ref on the slow path, while dma_chan_put() drops the reference unconditionally. This causes a m...

EUVD-2026-93328

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

EUVD-2026-93329

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

CVE-2026-98343

The Linux kernel contains a use-after-free vulnerability in the dmaengine component, specifically within the dma_chan_put() and dma_release_channel() functions. The issue occurs because dma_device_put() can drop the last reference on chan->device->ref, triggering dma_device_release() and fr...

CVE-2026-98342

The Linux kernel dmaengine component contains a vulnerability where dma_device_release() unlinks a device using list_del_RCU() and subsequently frees it without ensuring a grace period. This allows concurrent RCU readers in dma_issue_pending_all() to access the device after it has been freed, pot...