CVE-2026-98311 wifi: virt_wifi: don't transfer operstate before register

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98311 wifi: virt_wifi: don't transfer operstate before register

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98310

The Linux kernel contains a vulnerability in the drm/xe driver where the __xe_shrinker_walk() function fails to acquire a runtime PM reference before walking the SYSTEM and TT LRUs . When shrinking a buffer outside of system memory while the GPU is runtime suspended, the invalidation of GPU mappi...

CVE-2026-98310 drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

EUVD-2026-93295

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98310 drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98309 drm/vc4: Use managed KMS polling to fix UAF on unbind

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...

CVE-2026-98308 ALSA: hda: trace PCM open only after assigning a stream

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98308

The Linux kernel contains a vulnerability in the ALSA: hda driver where a tracepoint was incorrectly positioned. The issue occurs because stream assignment can fail when hardware streams are exhausted; however, the existing tracepoint payload attempted to access the assigned stream tag before a N...

EUVD-2026-93294

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...

CVE-2026-98309

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the drm/vc4 driver. The issue occurs because vc4_kms_load() calls drm_kms_helper_poll_init() without a corresponding drm_kms_helper_poll_fini(). Consequently, output poll work remains scheduled after an unbind operation and execute...

CVE-2026-98309 drm/vc4: Use managed KMS polling to fix UAF on unbind

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Use managed KMS polling to fix UAF on unbind vc4kmsload calls drmkmshelperpollinit but the driver provides no matching drmkmshelperpollfini. The output poll work stays scheduled after unbind and runs on the freed...

EUVD-2026-93293

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98308 ALSA: hda: trace PCM open only after assigning a stream

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: trace PCM open only after assigning a stream Stream assignment can fail when hardware streams are exhausted. Move the tracepoint after the NULL check because its payload accesses the assigned stream tag. Detected by...

CVE-2026-98307

The Linux kernel contains a memory leak vulnerability within the ath11k driver. When the firmware crashes, the driver calls ieee80211_restart_hw(), which expects all driver-related resources to be cleaned up. However, ath11k_mac_peer_cleanup_all() fails to free arsta->rx_stats and tx_stats res...

CVE-2026-98307 wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

EUVD-2026-93292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

CVE-2026-98307 wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

CVE-2026-98306 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98306

The Linux kernel contains a vulnerability where the IPSKB_L3SLAVE flag is not set during IPIP decapsulation , despite being set for IPv6. Specifically, while vrf_ip6_rcv() sets IP6SKB_L3SLAVE in the IPv6 control block, decap_and_validate() fails to set IPSKB_L3SLAVE in the IPv4 control block. Thi...