EUVD-2026-93302

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

CVE-2026-98316 ALSA: bcd2000: Fix race between rawmidi and disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98316

The Linux kernel contains a race condition in the ALSA: bcd2000 driver. During a USB disconnect, a Use-After-Free (UAF) vulnerability can occur because the rawmidi trigger callback might still access a URB (USB Request Block) while the driver handles the disconnect. The root cause is that the pre...

EUVD-2026-93301

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98316 ALSA: bcd2000: Fix race between rawmidi and disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98315

The Linux kernel contains a vulnerability in the ntfs filesystem driver where ntfs_non_resident_attr_shrink() fails to hold the runlist write lock while freeing clusters and truncating the runlist. This lack of synchronization can lead to race conditions during runlist updates. Additionally, ntfs...

EUVD-2026-93300

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98313

The Linux kernel contains a vulnerability in the drm/msm/dp driver where msm_dp_display_atomic_disable() writes DP_STATE_CTRL_PUSH_IDLE even if link training fails and the link was never enabled. Because this specific write is not gated on the power_on flag, the controller's runtime-PM reference ...

EUVD-2026-93299

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

EUVD-2026-93298

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98314

The Linux kernel contains a vulnerability in the ALSA subsystem where snd_pcm_timer_init() calls snd_device_register() before assigning timer->private_data. This creates a brief window where the timer is visible on the global list while its private_data pointer is still NULL . Concurrent reade...

CVE-2026-98312

The Linux kernel contains an out-of-bounds (OOB) write vulnerability in the ALSA 6fire driver within the usb6fire_pcm_in_urb_handler() function. The issue stems from a calculation of outgoing isochronous packet sizes where a device-reported actual_length of less than 4 causes an integer wrap-arou...

EUVD-2026-93297

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312 ALSA: 6fire: fix OOB write from device-reported iso length

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...