CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062

The Linux kernel contains a vulnerability in the vsock/virtio component where virtio_transport_read_skb() incorrectly manages byte accounting. After a partial stream receive, the function dequeues a packet but passes the full pkt_len for both buf_used and peer credit counters, causing rx_bytes to...

EUVD-2026-108728

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99062 vsock/virtio: account only unread bytes in read_skb()

In the Linux kernel, the following vulnerability has been resolved: vsock/virtio: account only unread bytes in readskb After a partial stream receive, rxbytes tracks the unread suffix while bufused and peer credit still cover the whole packet. virtiotransportreadskb dequeues that packet but passe...

CVE-2026-99061 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99061

The Linux kernel contains a race condition in the brcmfmac driver during P2P device removal. When the driver is removed while a user-space process (such as wpa_suppliant ) is exiting, the P2P device interface can be removed twice, leading to a kernel crash . Specifically, a race occurs between nl...

EUVD-2026-108727

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99061 wifi: brcmfmac: fix P2P device removal race in brcmf_detach()

In the Linux kernel, the following vulnerability has been resolved: wifi: brcmfmac: fix P2P device removal race in brcmfdetach When the driver is removed while the user space process that created the P2P device e.g. wpasupplicant is still exiting, the P2P device interface is removed twice and the...

CVE-2026-99060 wifi: mt76: mt7603: initialize global station WCID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

EUVD-2026-108726

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

CVE-2026-99060 wifi: mt76: mt7603: initialize global station WCID

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

CVE-2026-99060

A vulnerability exists in the Linux kernel 's mt7603 driver. The driver uses a driver-private global station WCID for frames without a station or vif, such as those injected via a monitor interface . Because this WCID is published without being passed to mt76_wcid_init(), the first injected frame...

CVE-2026-99059

The Linux kernel contains a vulnerability in the WireGuard noise protocol where two threads may process the same response message simultaneously. A race condition occurs because while thread B is performing a slow calculation, thread A completes and a third thread C initiates a new handshake, res...

CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

EUVD-2026-108725

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99058

The Linux kernel contains a vulnerability in the workqueue subsystem where a NULL pointer dereference can occur during a chained work check. The current_wq_worker() function identifies a kworker , but it does not guarantee the worker is actively executing a work item; the worker->current_pwq m...

CVE-2026-99058 workqueue: Fix NULL current_pwq deref in chained work check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

EUVD-2026-108724

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

CVE-2026-99058 workqueue: Fix NULL current_pwq deref in chained work check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...