CVE-2026-98926 drm/amd/display: Remove sink usage from DPMS

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98925 bpf, sockmap: Fix self-redirect copied_seq double-counting

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

EUVD-2026-108891

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98925

The Linux kernel contains a vulnerability in bpf, sockmap where a BPF stream_verdict program performing a self-redirect (with BPF_F_INGRESS ) causes double-counting of tcp_sk->copied_seq. When sk_psock_verdict_apply() calls tcp_eat_skb(), it advances the sequence counter; however, the same pac...

EUVD-2026-108888

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98924

A vulnerability in the Linux kernel causes hung tasks when users attempt to unmount a filesystem after its disk has been removed while still in use. The issue occurs because fs_bdev_mark_dead() calls evict_inodes() while holding s_umount . Specifically, whenever evict_inodes() drops s_inode_list_...

CVE-2026-98924 fs: avoid repeated scans in evict_inodes()

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98923 arm64: io: Reject non-user protection in ioremap_prot()

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98923

The Linux kernel (arm64 architecture) contains a vulnerability where mapping a stack-top page via /dev/mem with PROT_NONE and subsequently reading /proc//cmdline triggers a spurious WARN in ioremap_prot(). This occurs because generic_access_phys() passes protection from a present-invalid PTE to i...

EUVD-2026-108887

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98922

The Linux kernel contains a vulnerability in the emac driver causing a NULL pointer dereference during driver initialization. The issue stems from a netdev_need_ops_lock() check in phy_link_topo_add_phy() occurring before netdev_ops were determined. The root cause was triggered by a change in loc...

CVE-2026-98922 net: emac: move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

EUVD-2026-108886

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

CVE-2026-98921 ovl: fix UAF in ovl_do_mkdir() debug print

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

CVE-2026-98921

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the ovl_do_mkdir() function within the overlay filesystem component. The issue occurs because the function prints the input dentry using %pd after calling vfs_mkdir(). Since a recent change in vfs_mkdir() causes it to call end_crea...

EUVD-2026-108885

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

CVE-2026-98920

The Linux kernel contains a vulnerability where direct mempool allocations for folio_queues skipped the alloc_hooks() wrapper. This caused missing alloc tagging when CONFIG_MEM_ALLOC_PROFILING_DEBUG=y is enabled, resulting in kernel warnings during file reads on a CIFS mount and missing data in /...

CVE-2026-98920 netfs: Fix missing alloc tagging of direct mempool allocations

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folioqueue ENOMEM in writeback by adding a mempool" added a mempool for the folioqueues and made the request, subrequest and folioqueu...

EUVD-2026-108884

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folioqueue ENOMEM in writeback by adding a mempool" added a mempool for the folioqueues and made the request, subrequest and folioqueu...

CVE-2026-98919

The Linux kernel 's drm/xe component contains a vulnerability in the adjust_idledly() function. The issue stems from multiple corner-case flaws including divide-by-zero errors when timestamp_base is 0, u32 overflows during tick-to-ns conversions, and improper clamping that can cause values to exc...