CVE-2026-98957 wifi: mt76: mt7915: disable rx napi when removing device

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

CVE-2026-98957

The Linux kernel contains a vulnerability in the mt76 driver for the mt7915 chipset. When unloading the mt7915e module on an MT7916 device, the driver fails to disable the napi before destruction, triggering multiple warnings in __netif_napi_del_locked() and page_pool_disable_direct_recycling(). ...

EUVD-2026-108931

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

CVE-2026-98956 ASoC: adau1372: allow sleepy powerdown GPIOs

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...

CVE-2026-98956

The Linux kernel contains a vulnerability in the ASoC: adau1372 driver related to how it handles powerdown GPIOs. Specifically, the driver previously called gpiod_set_value(), which triggered a WARN message when interacting with GPIO providers that indicate they can sleep (common in I2C controlle...

EUVD-2026-108930

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...

CVE-2026-98955 flow_dissector: avoid u16 truncation of skb->len when computing thoff

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ? skb-len : hlen; mintu16, ... casts both arguments to u16 before comparin...

CVE-2026-98955

The Linux kernel contains a vulnerability in the __skb_flow_dissect() function where key_control->thoff is computed using min_t(u16, ...). This causes a u16 truncation of skb->len; if skb->len modulo 65536 is smaller than nhoff, thoff is set to a bogus small value . This can lead callers...

EUVD-2026-108929

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ? skb-len : hlen; mintu16, ... casts both arguments to u16 before comparin...

CVE-2026-98954 net: always dissect GSO packets in __virtio_net_hdr_to_skb()

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-networkheader' check before flow-dissecting GSO packets without...

CVE-2026-98953 devlink: fix devlink_rel reference leak when notify work is pending

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlinkrel reference leak when notify work is pending devlinkrelnestedinnotifyworkschedule takes a reference on the devlinkrel for the notify work and then queues the work, ignoring the return value of...

EUVD-2026-108927

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlinkrel reference leak when notify work is pending devlinkrelnestedinnotifyworkschedule takes a reference on the devlinkrel for the notify work and then queues the work, ignoring the return value of...

EUVD-2026-108928

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-networkheader' check before flow-dissecting GSO packets without...

CVE-2026-98954

The Linux kernel contains a vulnerability in the __virtio_net_hdr_to_skb() function where certain callers (such as tun_get_user(), tun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) failed to initialize skb->network_header and skb->dev. This caused a bypass of flow dissection f...

CVE-2026-98953

The Linux kernel contains a reference leak vulnerability within the devlink component. The issue occurs in devlink_rel_nested_in_notify_work_schedule() and the reschedule path of devlink_rel_nested_in_notify_work(), where the system takes a reference on the devlink_rel but fails to drop it if the...

CVE-2026-98952 pfcp: make sure the SEID is linear before reading it

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

CVE-2026-98952 pfcp: make sure the SEID is linear before reading it

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

CVE-2026-98952

The Linux kernel is vulnerable to an out-of-bounds read in the PFCP (Packet Forwarding Control Protocol) implementation. The function pfcp_encap_recv() fails to verify that the 8-byte SEID is within the linear area when the S flag is set, as it only checks the initial 4-byte PFCP header. This all...

EUVD-2026-108926

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

CVE-2026-98951 riscv: ptrace: Zero-initialize regset buffers before copyin

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...