EUVD-2026-93297

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312

The Linux kernel contains an out-of-bounds (OOB) write vulnerability in the ALSA 6fire driver within the usb6fire_pcm_in_urb_handler() function. The issue stems from a calculation of outgoing isochronous packet sizes where a device-reported actual_length of less than 4 causes an integer wrap-arou...

EUVD-2026-93296

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98311 wifi: virt_wifi: don't transfer operstate before register

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98311

The Linux kernel contains a vulnerability in the virt_wifi component where virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). When the lower device is dormant, the new network device is queued on the lweventlist while still uninitialized. If registration sub...

CVE-2026-98310

The Linux kernel contains a vulnerability in the drm/xe driver where the __xe_shrinker_walk() function fails to acquire a runtime PM reference before walking the SYSTEM and TT LRUs . When shrinking a buffer outside of system memory while the GPU is runtime suspended, the invalidation of GPU mappi...

EUVD-2026-93295

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

EUVD-2026-93293

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

EUVD-2026-93294

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...

CVE-2026-98309

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the drm/vc4 driver. The issue occurs because vc4_kms_load() calls drm_kms_helper_poll_init() without a corresponding drm_kms_helper_poll_fini(). Consequently, output poll work remains scheduled after an unbind operation and execute...

CVE-2026-98308

The Linux kernel contains a vulnerability in the ALSA: hda driver where a tracepoint was incorrectly positioned. The issue occurs because stream assignment can fail when hardware streams are exhausted; however, the existing tracepoint payload attempted to access the assigned stream tag before a N...

EUVD-2026-93292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

CVE-2026-98307

The Linux kernel contains a memory leak vulnerability within the ath11k driver. When the firmware crashes, the driver calls ieee80211_restart_hw(), which expects all driver-related resources to be cleaned up. However, ath11k_mac_peer_cleanup_all() fails to free arsta->rx_stats and tx_stats res...

CVE-2026-98306

The Linux kernel contains a vulnerability where the IPSKB_L3SLAVE flag is not set during IPIP decapsulation , despite being set for IPv6. Specifically, while vrf_ip6_rcv() sets IP6SKB_L3SLAVE in the IPv6 control block, decap_and_validate() fails to set IPSKB_L3SLAVE in the IPv4 control block. Thi...

CVE-2026-98306 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

EUVD-2026-93291

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98305

The Linux kernel contains a vulnerability in the net: dsa: mxl862xx driver where the stats poll is not correctly disabled during teardown. The mxl862xx_setup() function arms the poll before mxl862xx_setup_mdio() , but if dsa_register_switch() returns an error, the dsa_port list is freed while the...

EUVD-2026-93290

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305 net: dsa: mxl862xx: disable the stats poll on teardown

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

EUVD-2026-93289

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...