EUVD-2026-103813

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

CVE-2026-98728

The Linux kernel contains an off-by-four bounds check vulnerability in the tpm2_get_random() function. When a response includes the TPM2_ST_SESSIONS tag, the function skips a 4-byte parameter size field but incorrectly validates the response length against TPM_HEADER_SIZE. This allows a truncated...

CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

EUVD-2026-103812

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLKFEATZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespac...

CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLKFEATZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespac...

CVE-2026-98727

The Linux kernel contains a vulnerability in nvme-multipath where the namespace head is incorrectly marked as zoned at allocation time based solely on the command set identifier. If a zone info query returns a zero zone size, the path namespace is registered without zoned limits, but the head con...

CVE-2026-98727 nvme-multipath: set BLK_FEAT_ZONED only after the zone info is known

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: set BLKFEATZONED only after the zone info is known The namespace head is marked zoned at allocation time based only on the command set identifier. If the zone info query reports a zero zone size, the path namespac...

CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

EUVD-2026-103811

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98726 nvme-multipath: fix underflow in ANA log bounds checks

In the Linux kernel, the following vulnerability has been resolved: nvme-multipath: fix underflow in ANA log bounds checks The number of ANA groups advertised through Identify Controller sizes the ANA log buffer. The ANA log header and group descriptors independently supply the number of groups a...

CVE-2026-98726

The Linux kernel contains a vulnerability in nvme-multipath due to an underflow during ANA log bounds checks . The root cause involves subtracting an untrusted object size from ana_log_size before comparing it against the current offset; if the object size exceeds the buffer, the size_t subtracti...

CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

CVE-2026-98725

The Linux kernel contains an out-of-bounds write vulnerability in the nvmet_auth_challenge() function within the nvmet-auth component. The root cause is that the output buffer is received as a void pointer , causing sizeof(*d) to evaluate to one under GCC . This results in an undercount of the fi...

EUVD-2026-103810

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

CVE-2026-98725 nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge()

In the Linux kernel, the following vulnerability has been resolved: nvmet-auth: fix out-of-bounds write in nvmetauthchallenge nvmetauthchallenge receives its output buffer as a void pointer. sizeofd therefore evaluates to one with GCC and undercounts the fixed challenge header by 15 bytes. A shor...

CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

CVE-2026-98724

The Linux kernel contains a vulnerability in the nvmet driver related to pci-epf SGL segments. A host-controlled SGL segment length that is nonzero but smaller than a single SGL descriptor causes nr_descs to become zero. This leads the function nvmet_pci_epf_get_sgl_segment() to perform an out-of...

CVE-2026-98724 nvmet: pci-epf: reject too-short SGL segments

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

EUVD-2026-103809

In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: reject too-short SGL segments The host controls an SGL segment's length. A nonzero length smaller than one SGL descriptor makes nrdescs zero, so nvmetpciepfgetsglsegment reads the type byte of sgls-1 outside the...

EUVD-2026-103977

In the Linux kernel, the following vulnerability has been resolved: nvmet: copy the hostid into the ctrl before creating PR pcrefs Commit 6202783184bf "nvmet: Improve nvmetallocctrl interface and implementation" added a second uuidcopy of args-hostid near the end of nvmetallocctrl, and commit...