CVE-2026-98886

The Linux kernel contains a vulnerability in the drm/gma500 driver related to Oaktrail HDMI I2C reads. The xfer_read() function improperly handles the wait_for_completion_interruptible_timeout() function by ignoring timeout and signal returns. If the interrupt fails to advance the transaction sta...

EUVD-2026-108680

In the Linux kernel, the following vulnerability has been resolved: drm/gma500: return errors from Oaktrail HDMI I2C reads xferread waits for the HDMI I2C transaction to reach I2CTRANSACTIONDONE, but it ignores both timeout and signal returns from waitforcompletioninterruptibletimeout. If the...

EUVD-2026-108679

In the Linux kernel, the following vulnerability has been resolved: ima: return error early if file xattr cannot be changed During early boot, the filesystem is read-only and any changes to xattrs are not allowed. This fails in case of ext4 because changing xattr starts an ext4 transaction which...

CVE-2026-98885

The Linux kernel contains a vulnerability in the ima (Integrity Measurement Architecture) subsystem where it fails to handle read-only filesystems correctly during early boot. Specifically, when the system attempts to change xattrs (extended attributes) on an ext4 filesystem that is currently rea...

EUVD-2026-108678

In the Linux kernel, the following vulnerability has been resolved: mmc: core: Add validation for host-provided maxsegs The maxsegs field is of type unsigned short, and if a host driver sets an excessively large value, it may be truncated to zero. This can cause mmcallocsg to call kmallocobjs wit...

CVE-2026-98884

The Linux kernel contains a vulnerability in the mmc core where an excessively large max_segs value provided by a host driver can be truncated to zero. This causes mmc_alloc_sg() to request a zero-sized allocation via kmalloc_objs(), returning a ZERO_SIZE_PTR under the SLUB allocator. Subsequent ...

CVE-2026-98883

The Linux kernel contains a vulnerability in the 8250 serial driver where the set_io_from_upio() function fails to recognize UPIO_AU (type 4) UART types. This causes an "Unsupported UART type 4" warning during the probe of the 8250 driver, specifically observed on MIPS Alchemy systems. The fix in...

EUVD-2026-108677

In the Linux kernel, the following vulnerability has been resolved: serial: 8250port: recognize UPIOAU My MIPS Alchemy systems generate the following warning during probe of the 8250 driver: WARNING: drivers/tty/serial/8250/8250port.c:462 at setiofromupio+0xfc/0x124, CPU0: swapper/0/1 Unsupported...

EUVD-2026-108676

In the Linux kernel, the following vulnerability has been resolved: media: chips-media: wave5: Add range checks for decoutputinfo If the driver's decoutputinfo contains invalid data the driver can write in invalid memory. Add a range check for that. This fixes this smatch error:...

CVE-2026-98882

The Linux kernel contains a vulnerability in the chips-media wave5 driver. If the driver's dec_output_info contains invalid data, it can result in a buffer overflow where the driver writes into invalid memory. Specifically, the wave5_vpu_dec_get_output_info() function in drivers/media/platform/ch...

CVE-2026-98881

The Linux kernel contains a vulnerability in the bridge component where a stale rcu_barrier() in br_multicast_dev_del() causes extreme RTNL pressure . This issue originated from historical call_rcu() usage in net/bridge/br_multicast.c . The vulnerability has been resolved by removing the problema...

EUVD-2026-108675

In the Linux kernel, the following vulnerability has been resolved: net: bridge: remove stale rcubarrier in brmulticastdevdel This rcubarrier came from a time callrcu calls were used in net/bridge/brmulticast.c. Now kfreercu is there, we can remove this problematic rcubarrier which causes extreme...

CVE-2026-98880

The Linux kernel contains a vulnerability in the ntfs3 filesystem module regarding how it handles set_blocksize failures. The issue stems from ntfs3 using buffer_heads , which do not correctly manage block sizes exceeding PAGE_SIZE . This failure can trigger a BUG_ON(offset >= folio_size(folio...

EUVD-2026-108674

In the Linux kernel, the following vulnerability has been resolved: ntfs3: handle setblocksize failures ntfs3 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98879

The Linux kernel contains a vulnerability in the isofs component where buffer_heads do not properly handle block sizes greater than PAGE_SIZE . This issue can lead to a BUG_ON(offset >= folio_size(folio)) error during the first __bread_gfp call in folio_set_bh when mounting. The provided docum...

EUVD-2026-108673

In the Linux kernel, the following vulnerability has been resolved: isofs: handle setblocksize failures isofs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-98878

The Linux kernel 's GICv5 driver contains a vulnerability where the priority drop (via the GIC CDEOI system instruction) was incorrectly performed as part of irq_eoi(). Because all interrupts are programmed with the same priority, a long-running process—such as software-injected interrupts for a ...

EUVD-2026-108672

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v5: Immediately exec priority drop following activate With GICv5 an interrupt of equal or lower priority cannot be signalled until there has been a priority drop. This is done via the GIC CDEOI system instruction. Onc...

CVE-2026-98877

The Linux kernel contains a vulnerability where setting kvm-arm.vgic_v4_enable=1 on a system with GICv4 but no MSI controller device tree node causes a kernel panic . The root cause is a NULL pointer dereference because the kernel attempts to access gic_domain when it is NULL. The fix involves se...

EUVD-2026-108723

In the Linux kernel, the following vulnerability has been resolved: irqchip/gic-v4: Don't advertise VLPIs if no ITS is probed When accidentally setting “kvm-arm.vgicv4enable=1” on a system that has no MSI controller device tree node and GICv4, it results a panic as “gicdomain” is NULL and the...