CVE-2026-98327 wifi: mac80211: mesh: reset the CSA state when leaving

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: reset the CSA state when leaving ifmsh-csa is allocated in ieee80211meshcsabeacon and only freed in ieee80211meshfinishcsa, i.e. when the channel switch completes. Leaving the mesh while a switch is still...

CVE-2026-98327

A vulnerability exists in the Linux kernel within the wifi: mac80211: mesh component. The issue occurs because ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() but is only freed in ieee80211_mesh_finish_csa() upon completion of a channel switch. If a user leaves the mesh while a switch i...

CVE-2026-98326 wifi: mac80211: mesh: release the channel if start fails

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

EUVD-2026-93311

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

CVE-2026-98326

The Linux kernel contains a vulnerability in the wifi: mac80211: mesh component where the ieee80211_join_mesh() function acquires a channel context but fails to release it if the subsequent ieee80211_start_mesh() call fails. This improper handling leads to a warning during interface removal becau...

CVE-2026-98326 wifi: mac80211: mesh: release the channel if start fails

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: mesh: release the channel if start fails ieee80211joinmesh acquires a channel context and then calls ieee80211startmesh, which can fail. In that case, the chanctx isn't released then interface removal will attempt...

CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98325

The Linux kernel contains a vulnerability in the wifi: mac80211 component where failed socket buffer (SKB) structures were not properly reported to userspace during certain failure paths. The issue stems from the timing of TX information setup; specifically, the skb->cb[] array was not initial...

EUVD-2026-93310

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98323

The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...

CVE-2026-98324

The Linux kernel contains a vulnerability within the dmaengine: pxa component caused by double counting of hardware descriptors . Specifically, when pxad_alloc_desc() was converted to use kzalloc_flex(), it began setting the sw_desc->nb_desc counter automatically in newer compilers (GCC 15.1+ ...

EUVD-2026-93308

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

EUVD-2026-93309

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98322 netfilter: nft_nat: fully initialise new_addr in netmap setup

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

EUVD-2026-93307

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...