CVE-2026-98900

The Linux kernel contains a vulnerability in the xen/gntalloc component where the gntalloc_ioctl_alloc() function allocates the grant-id array before verifying if the requested count exceeds the global grant limit. This allows user-controlled allocations to reach kcalloc() even when they should b...

CVE-2026-98900 xen/gntalloc: validate grant count before allocation

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

EUVD-2026-108855

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98899 netfilter: ipset: mark the rcu locked areas properly

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98899 netfilter: ipset: mark the rcu locked areas properly

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98899

The Linux kernel contains a vulnerability in the netfilter: ipset component. The issue stems from improper handling of RCU locked areas ; specifically, when bumping the uref counter , the RCU lock does not need to be maintained because the referred hash table cannot disappear. Additionally, it wa...

CVE-2026-98898 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. cherry picke...

CVE-2026-98898

The Linux kernel contains a vulnerability within the drm/amd/pm/si component. When DPM is disabled using the amdgpu.dpm=0 module parameter, the thermal work queue is not initialized. The issue is caused by the system attempting to schedule work on this uninitialized queue. The vulnerability has b...

EUVD-2026-108854

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. cherry picke...

CVE-2026-98897

The Linux kernel (ksmbd) contains a concurrency issue where the system holds the ci->m_lock for read while waiting for a lease break acknowledgment in wait_for_break_ack() for up to 35 seconds. This creates a deadlock scenario with cifs.ko clients: when a client closes a deferred handle, it at...

EUVD-2026-108853

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci-mlock while waiting for a lease break ack When a cifs.ko client caches a read-handle RH lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in...

CVE-2026-98897 ksmbd: don't hold ci->m_lock while waiting for a lease break ack

In the Linux kernel, the following vulnerability has been resolved: ksmbd: don't hold ci-mlock while waiting for a lease break ack When a cifs.ko client caches a read-handle RH lease via deferred close and a conflicting open arrives, ksmbd breaks the lease and waits for the acknowledgment in...

CVE-2026-98896 thunderbolt: Keep the domain reference while processing hotplug

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

EUVD-2026-108690

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98896

The Linux kernel contains a vulnerability in the thunderbolt driver where hotplug events are processed in a workqueue. This can lead to a Use-After-Free (UAF) condition if the domain is removed via tb_domain_remove() (e.g., during a driver unload) while the tb_handle_hotplug() handler is still sc...

EUVD-2026-108689

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98895 net/mlx5: HWS, Handle destroying table that has a miss table

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98895 net/mlx5: HWS, Handle destroying table that has a miss table

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: HWS, Handle destroying table that has a miss table If a table has a miss table that was created by 'mlx5hwstablesetdefaultmiss' API function, its misstbl keeps the table that points to it in a list. If such table is...

CVE-2026-98895

The Linux kernel is affected by a vulnerability in the net/mlx5 driver (HWS). Specifically, when a table is created using the mlx5hws_table_set_default_miss API, the associated miss_tbl maintains a list containing the table that points to it. The root cause is a failure to remove the table from t...

EUVD-2026-108688

In the Linux kernel, the following vulnerability has been resolved: drm/amd/ras: reset CPER ring on corrupt entry size When CPER ring overflow handling advances the read pointer, it trusts the parsed entry size from the current ring contents. Corrupt CPER data can produce an entry size that does...