CVE-2026-98952

The Linux kernel is vulnerable to an out-of-bounds read in the PFCP (Packet Forwarding Control Protocol) implementation. The function pfcp_encap_recv() fails to verify that the 8-byte SEID is within the linear area when the S flag is set, as it only checks the initial 4-byte PFCP header. This all...

CVE-2026-98952 pfcp: make sure the SEID is linear before reading it

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

CVE-2026-98952 pfcp: make sure the SEID is linear before reading it

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

EUVD-2026-108925

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

CVE-2026-98951 riscv: ptrace: Zero-initialize regset buffers before copyin

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

CVE-2026-98951

The Linux kernel contains a vulnerability in the riscv architecture's ptrace implementation. The user_regset_copyin() function only copies a specific number of bytes, which can leave a portion of the stack buffer uninitialized when a PTRACE_SETREGSET request is made with a short iov_len. This uni...

EUVD-2026-108924

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98950 flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98950

The Linux kernel contains a vulnerability in the bpf_flow_dissect() function where the hlen (header length) parameter can undergo u16 truncation during offset sanitization. When hlen exceeds 65535, the upper bound is truncated before being used in clamp_t(u16, ..., hlen) . For example, if hlen is...

EUVD-2026-108923

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98948 mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

EUVD-2026-108922

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

CVE-2026-98949 drm/imagination: Fix reference and vm_bo handling in remap()

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98949

The Linux kernel contains a vulnerability in the drm/imagination driver within the pvr_vm_gpuva_remap() function. When a map overlaps an existing mapping, the function incorrectly splits the mapping and fails to handle references and vm_bo links correctly. Specifically, it leaks one GEM reference...

CVE-2026-98948

The Linux kernel contains a resource leak vulnerability in the mlxsw: spectrum_flower driver. The function mlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template into a stack-local struct to compute rulei.values.elusage. During this process, the mlxsw_sp_flower_parse_ports_range() func...

EUVD-2026-108921

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947

The Linux kernel contains a memory leak vulnerability within the vmci_transport_recv_dgram_cb() function. During the closure of a datagram socket , this function may add packets to the socket's backlog. Subsequently, the __release_sock() function moves these packets from the backlog back to the r...

CVE-2026-98946 drm/vc4: Disable the V3D interrupt across runtime suspend

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

EUVD-2026-108920

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...