CVE-2026-98908 net: microchip: sparx5: clean up PSFP resources on flower setup failure

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources...

CVE-2026-98907 btrfs: protect sb_write_pointer() with invalidate lock

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

CVE-2026-98907

The Linux kernel contains a vulnerability within the btrfs filesystem where the sb_write_pointer() function reads the super block from the block device page cache using read_cache_page_gfp(). This operation is susceptible to a race condition with BLKBSZSET , similar to an issue addressed in previ...

CVE-2026-98907 btrfs: protect sb_write_pointer() with invalidate lock

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

EUVD-2026-108863

In the Linux kernel, the following vulnerability has been resolved: btrfs: protect sbwritepointer with invalidate lock sbwritepointer reads the super block from the block device page cache using readcachepagegfp. This has the same race with BLKBSZSET as the one fixed by commit 3f29d661e568 "btrfs...

CVE-2026-98906 net: lan966x: restore RX state on reload failure

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

EUVD-2026-108862

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

CVE-2026-98906

The Linux kernel contains a vulnerability in the lan966x driver where a failed RX resource reallocation during an MTU change results in an inconsistent state. Specifically, while the driver backs up rx->page_pool and rx->fdma, it fails to restore rx->page_order and rx->max_mtu on fail...

CVE-2026-98906 net: lan966x: restore RX state on reload failure

In the Linux kernel, the following vulnerability has been resolved: net: lan966x: restore RX state on reload failure lan966xfdmareload backs up rx-pagepool and rx-fdma before reallocating the RX resources for the new MTU. If the allocation fails, the restore path puts these fields back before...

CVE-2026-98905 drm/amdkfd: Properly acquire queue buffers in CRIU restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...

CVE-2026-98905 drm/amdkfd: Properly acquire queue buffers in CRIU restore

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...

CVE-2026-98905

The Linux kernel contains a vulnerability in the drm/amdkfd component related to CRIU restore operations. When the function kfd_queue_acquire_buffers() was separated from set_queue_properties_from_user(), the set_queue_properties_from_criu() function was not updated to include the necessary calls...

EUVD-2026-108861

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Properly acquire queue buffers in CRIU restore When kfdqueueacquirebuffers was split off from setqueuepropertiesfromuser, setqueuepropertiesfromcriu was missed. Thus, setqueuepropertiesfromcriu is not filling out the...

CVE-2026-98904

The Linux kernel contains a vulnerability in the mailbox: imx driver related to the premature usage of the device before the probe process is completed. The issue is addressed by switching to devm_pm_runtime_enable() and reordering the initialization sequence. Specifically, the pm_runtime_enable(...

CVE-2026-98904 mailbox: imx: Use devm_pm_runtime_enable()

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pmruntimeenable into the removal path instead doing it early. This ensure...

EUVD-2026-108860

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pmruntimeenable into the removal path instead doing it early. This ensure...

CVE-2026-98904 mailbox: imx: Use devm_pm_runtime_enable()

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Use devmpmruntimeenable sashiko complained about early usage of the device while probe isn't completed. This can be mitigated by delaying the pmruntimeenable into the removal path instead doing it early. This ensure...

CVE-2026-98903 mailbox: imx: Add a channel shutdown field

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

CVE-2026-98903

The Linux kernel contains a race condition in the mailbox: imx driver during channel teardown. A timing issue occurs where an RX event remains enabled because it is disabled in imx_mu_shutdown() while the interrupt is active, then re-enabled by imx_mu_isr() while shutdown() waits in free_irq(). T...

CVE-2026-98903 mailbox: imx: Add a channel shutdown field

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...