CVE-2026-98893 firmware: arm_scmi: Validate SENSOR_UPDATE payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate SENSORUPDATE payload size SENSORUPDATE carries one or more sensor readings after the fixed notification header. The parser derives the expected reading count from the sensor description, but it did not...

EUVD-2026-108686

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

CVE-2026-98892

The Linux kernel contains a vulnerability in the arm_scmi firmware component. The BASE_ERROR_EVENT carries a variable number of message reports, where the count is encoded in the error_status . The notification parser incorrectly used this count without verifying if the received payload contained...

CVE-2026-98892 firmware: arm_scmi: Validate BASE_ERROR_EVENT payload size

In the Linux kernel, the following vulnerability has been resolved: firmware: armscmi: Validate BASEERROREVENT payload size BASEERROREVENT carries a variable number of message reports, with the count encoded in errorstatus. The notification parser used that count without checking whether the...

EUVD-2026-108685

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211rxmgmtdeauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length...

CVE-2026-98891

The Linux kernel contains a vulnerability in the wifi: mac80211 component. The function ieee80211_rx_mgmt_deauth() incorrectly reads the deauth reason code before verifying that the fixed field is actually present in the received frame. The vulnerability is addressed by validating the deauth fram...

CVE-2026-98891 wifi: mac80211: validate deauth frame length before reason access

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate deauth frame length before reason access ieee80211rxmgmtdeauth reads the deauth reason code before checking that the fixed field is actually present in the received frame. Validate the deauth frame length...

EUVD-2026-108684

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbshardstartxmit casts skb-data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The...

CVE-2026-98890

The Linux kernel contains a vulnerability in the libertas wifi driver. Specifically, in monitor mode, the function lbs_hard_start_xmit() fails to perform sufficient length checks when casting skb->data to a radiotap TX header . Because the generic check only rejects zero-length or oversized sk...

CVE-2026-98890 wifi: libertas: reject short monitor TX frames

In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbshardstartxmit casts skb-data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. The...

EUVD-2026-108683

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889 wifi: iwlwifi: mvm: fix sched scan IE sizing

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mvm: fix sched scan IE sizing Scheduled scan built the probe request before iwlmvmscanfits, so oversized IEs could be copied into the fixed preq buffer before length validation. Move iwlmvmbuildscanprobe after the...

CVE-2026-98889

The Linux kernel 's iwlwifi driver contains a vulnerability where scheduled scans built probe requests before the iwl_mvm_scan_fits() check. This allowed oversized Information Elements (IEs) to be copied into a fixed preq buffer without prior length validation . To resolve this, the driver was up...

EUVD-2026-108682

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBEHITSS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe ...

CVE-2026-98888

The Linux kernel (arm64 architecture) contains a flaw where kprobes are incorrectly treated as unrecoverable when hit while in a KPROBE_HIT_SS state. This occurs when tracing or perf code runs from the debug exception path during out-of-line single-step execution. The issue causes the kernel to l...

CVE-2026-98888 arm64: kprobes: Allow reentering kprobes while single-stepping

In the Linux kernel, the following vulnerability has been resolved: arm64: kprobes: Allow reentering kprobes while single-stepping A kprobe can be hit while another kprobe is in KPROBEHITSS state. This can happen when tracing or perf code runs from the debug exception path while the first kprobe ...

EUVD-2026-108681

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO hwsimtxinfoframereceivednl casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries 8 bytes from it. The policy only...

CVE-2026-98887 wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: reject undersized HWSIMATTRTXINFO hwsimtxinfoframereceivednl casts the HWSIMATTRTXINFO payload to a struct hwsimtxrate and unconditionally reads IEEE80211TXMAXRATES entries 8 bytes from it. The policy only...

CVE-2026-98887

The Linux kernel contains a vulnerability in the wifi: mac80211_hwsim component. The function hwsim_tx_info_frame_received_nl() incorrectly handles the HWSIM_ATTR_TX_INFO payload by casting it to a struct hwsim_tx_rate * and reading 8 bytes of IEEE80211_TX_MAX_RATES entries. Because the policy on...