CVE-2026-98346

The Linux kernel contains a vulnerability in the cfg80211 component where the function cfg80211_calculate_bi_data() calls rdev_get_radio_mask() using wdev->netdev. Because wdev->netdev can be NULL for certain network device types, this leads to a crash in mac80211 . The fix involves inverti...

EUVD-2026-93331

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98346 wifi: cfg80211: don't get the radio mask for netdev-less wdevs

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

CVE-2026-98346 wifi: cfg80211: don't get the radio mask for netdev-less wdevs

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: don't get the radio mask for netdev-less wdevs cfg80211calculatebidata calls rdevgetradiomask with wdev-netdev, which can be NULL and then crashes in mac80211. To avoid that, invert the order of checks since...

EUVD-2026-93330

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98345

The Linux kernel contains a vulnerability within the cfg80211 component, specifically in the cfg80211_classify8021d() function. The issue occurs when a frame mimicking an IP packet is transmitted but is too short, causing the DS field to be read incorrectly. This leads to an uninit-value error as...

CVE-2026-98345 wifi: cfg80211: check IP header size in cfg80211_classify8021d()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98345 wifi: cfg80211: check IP header size in cfg80211_classify8021d()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98343

The Linux kernel contains a use-after-free vulnerability in the dmaengine component, specifically within the dma_chan_put() and dma_release_channel() functions. The issue occurs because dma_device_put() can drop the last reference on chan->device->ref, triggering dma_device_release() and fr...

CVE-2026-98343 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

EUVD-2026-93328

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

EUVD-2026-93329

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

CVE-2026-98344 dmaengine: Fix device kref underflow in dma_chan_put()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

CVE-2026-98344

The Linux kernel contains a vulnerability in the dmaengine component involving a device kref underflow in dma_chan_put(). The issue occurs because dma_chan_get() only increments the chan->device->ref on the slow path, while dma_chan_put() drops the reference unconditionally. This causes a m...

CVE-2026-98344 dmaengine: Fix device kref underflow in dma_chan_put()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: Fix device kref underflow in dmachanput dmachanget takes chan-device-ref only on the slow path: / no kref on fast path / if chan-clientcount modulegetowner; chan-clientcount++; return 0; if !trymodulegetowner return...

CVE-2026-98343 dmaengine: fix use-after-free in dma_chan_put() and dma_release_channel()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: fix use-after-free in dmachanput and dmareleasechannel When dmadeviceput drops the last reference on chan-device-ref, dmadevicerelease runs and may free the dmadevice along with its channels. dmachanput then still read...

CVE-2026-98342 dmaengine: wait for RCU readers before releasing dma_device

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...

CVE-2026-98342

The Linux kernel dmaengine component contains a vulnerability where dma_device_release() unlinks a device using list_del_RCU() and subsequently frees it without ensuring a grace period. This allows concurrent RCU readers in dma_issue_pending_all() to access the device after it has been freed, pot...

EUVD-2026-93327

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...

CVE-2026-98342 dmaengine: wait for RCU readers before releasing dma_device

In the Linux kernel, the following vulnerability has been resolved: dmaengine: wait for RCU readers before releasing dmadevice dmaissuependingall walks the dmadevicelist with listforeachentryrcu under rcureadlock. dmadevicerelease unlinks the device with listdelrcu and then calls...