CVE-2026-98903

The Linux kernel contains a race condition in the mailbox: imx driver during channel teardown. A timing issue occurs where an RX event remains enabled because it is disabled in imx_mu_shutdown() while the interrupt is active, then re-enabled by imx_mu_isr() while shutdown() waits in free_irq(). T...

EUVD-2026-108859

In the Linux kernel, the following vulnerability has been resolved: mailbox: imx: Add a channel shutdown field sashiko complained about possible teardown problem. The scenario CPU 0 CPU 1 imxmuisr imxmushutdown imxmuxcrrmwpriv, IMXMURCR, 0, IMXMUxCRRIEnpriv-dcfg-type, cp-idx; imxmuspecificrx...

CVE-2026-98902 md/raid5: let stripe batch bm_seq comparison wrap-safe

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

CVE-2026-98902 md/raid5: let stripe batch bm_seq comparison wrap-safe

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

EUVD-2026-108858

In the Linux kernel, the following vulnerability has been resolved: md/raid5: let stripe batch bmseq comparison wrap-safe Once the 32-bit seq wraps, a newer bmseq can look smaller than old, so .. covert to wrap-safe calculate way...

CVE-2026-98902

The Linux kernel contains a vulnerability in the md/raid5 component related to how bm_seq comparisons are handled. The root cause is that once the 32-bit seq wraps, a newer bm_seq might appear smaller than an older one. The issue is resolved by converting the logic to a wrap-safe calculation meth...

CVE-2026-98901

The Linux kernel 's ksmbd component contained a flaw in lease break and ack state handling . Specifically, the system failed to preserve valid lease states containing WRITE_CACHING when breaking level-II/read leases for writes and truncates. Additionally, lease break acknowledgments did not consi...

CVE-2026-98901 ksmbd: fix lease break and ack state handling

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

EUVD-2026-108857

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

CVE-2026-98901 ksmbd: fix lease break and ack state handling

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix lease break and ack state handling Do not skip valid lease states containing WRITECACHING when breaking level-II/read leases for writes and truncates. Handle lease break acknowledgments according to the SMB2 rule that...

EUVD-2026-108856

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98900 xen/gntalloc: validate grant count before allocation

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98900 xen/gntalloc: validate grant count before allocation

In the Linux kernel, the following vulnerability has been resolved: xen/gntalloc: validate grant count before allocation gntallocioctlalloc allocates the grant-id array before checking whether the requested count fits within the global grant limit. Counts above that limit cannot succeed, so rejec...

CVE-2026-98900

The Linux kernel contains a vulnerability in the xen/gntalloc component where the gntalloc_ioctl_alloc() function allocates the grant-id array before verifying if the requested count exceeds the global grant limit. This allows user-controlled allocations to reach kcalloc() even when they should b...

CVE-2026-98899

The Linux kernel contains a vulnerability in the netfilter: ipset component. The issue stems from improper handling of RCU locked areas ; specifically, when bumping the uref counter , the RCU lock does not need to be maintained because the referred hash table cannot disappear. Additionally, it wa...

EUVD-2026-108855

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98899 netfilter: ipset: mark the rcu locked areas properly

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98899 netfilter: ipset: mark the rcu locked areas properly

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: mark the rcu locked areas properly When we bump the uref counter, there's no need to keep the rcu lock because the referred hash table can't disappear. Also, from the same reason in mtypegc we need the rcu lock...

CVE-2026-98898 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. cherry picke...

CVE-2026-98898 drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized

In the Linux kernel, the following vulnerability has been resolved: drm/amd/pm/si: Don't schedule thermal work when queue isn't initialized When DPM is turned off with the amdgpu.dpm=0 module parameter, the thermal work queue isn't initialized so we shouldn't schedule any work on it. cherry picke...