EUVD-2026-108903

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98931

The Linux kernel contains a vulnerability in the mtd: spinand component where a NULL pointer dereference occurs when the "nand-no-ecc-engine" property is set in the Device Tree. Specifically, nanddev_get_ecc_engine() returns success while leaving nand->ecc.engine as NULL, but the SPI-NAND code...

CVE-2026-98931 mtd: spinand: fix NULL pointer dereference with no ECC engine

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

EUVD-2026-108901

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When injectsigpstop is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread...

EUVD-2026-108899

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsgifinfobuildskb when IPv4 forwarding is enabled by default...

CVE-2026-98929

The Linux kernel contains a vulnerability in the macsec driver where the SecY is initialized after the netdevice is registered. When creating a MACsec device with MAC offload over an LRO-capable lower device, register_netdevice() triggers a NETDEV_FEAT_CHANGE notification before macsec_add_dev() ...

CVE-2026-98929 macsec: initialize SecY before registering the netdevice

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsgifinfobuildskb when IPv4 forwarding is enabled by default...

EUVD-2026-108898

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUESTHASSVE from the SVE feature bit at EL2 pkvminitfeaturesfromhost takes KVMARCHFLAGGUESTHASSVE and KVMARMVCPUSVE from the host separately, but pkvmvcpuinitsve tests the bit while vcpuhassve reads the flag. A...

CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

EUVD-2026-108893

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98927

The Linux kernel contains a vulnerability in KVM on arm64 architectures regarding the life cycle of the nested_mmus array. The issue stems from these structures being allocated during VCPU_INIT, which could trigger a relocation of the array as it grows. If a relocation occurs while a vcpu is acti...

CVE-2026-98927 KVM: arm64: nv: Fix life cycle of the nested_mmus array

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

EUVD-2026-108892

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98926

The Linux kernel contains a vulnerability within the drm/amd/display component related to improper null pointer dereferences. The issue arises because stream->sink is optional and can be null, yet it is accessed without sufficient validation during DPMS (Display Power Management Signaling) seq...

CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98925

The Linux kernel contains a vulnerability in bpf, sockmap where a BPF stream_verdict program performing a self-redirect (with BPF_F_INGRESS ) causes double-counting of tcp_sk->copied_seq. When sk_psock_verdict_apply() calls tcp_eat_skb(), it advances the sequence counter; however, the same pac...

EUVD-2026-108891

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

EUVD-2026-108888

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98924

A vulnerability in the Linux kernel causes hung tasks when users attempt to unmount a filesystem after its disk has been removed while still in use. The issue occurs because fs_bdev_mark_dead() calls evict_inodes() while holding s_umount . Specifically, whenever evict_inodes() drops s_inode_list_...