CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98313

The Linux kernel contains a vulnerability in the drm/msm/dp driver where msm_dp_display_atomic_disable() writes DP_STATE_CTRL_PUSH_IDLE even if link training fails and the link was never enabled. Because this specific write is not gated on the power_on flag, the controller's runtime-PM reference ...

CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98314

The Linux kernel contains a vulnerability in the ALSA subsystem where snd_pcm_timer_init() calls snd_device_register() before assigning timer->private_data. This creates a brief window where the timer is visible on the global list while its private_data pointer is still NULL . Concurrent reade...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

EUVD-2026-93299

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

EUVD-2026-93298

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98312 ALSA: 6fire: fix OOB write from device-reported iso length

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312

The Linux kernel contains an out-of-bounds (OOB) write vulnerability in the ALSA 6fire driver within the usb6fire_pcm_in_urb_handler() function. The issue stems from a calculation of outgoing isochronous packet sizes where a device-reported actual_length of less than 4 causes an integer wrap-arou...

EUVD-2026-93297

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312 ALSA: 6fire: fix OOB write from device-reported iso length

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

EUVD-2026-93296

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98311 wifi: virt_wifi: don't transfer operstate before register

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

CVE-2026-98311

The Linux kernel contains a vulnerability in the virt_wifi component where virt_wifi_newlink() calls netif_stacked_transfer_operstate() before register_netdevice(). When the lower device is dormant, the new network device is queued on the lweventlist while still uninitialized. If registration sub...

CVE-2026-98311 wifi: virt_wifi: don't transfer operstate before register

In the Linux kernel, the following vulnerability has been resolved: wifi: virtwifi: don't transfer operstate before register virtwifinewlink calls netifstackedtransferoperstate before registernetdevice. If the lower device is dormant, that queues the new netdev on lweventlist while it is still...

EUVD-2026-93295

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98310 drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...

CVE-2026-98310 drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory

In the Linux kernel, the following vulnerability has been resolved: drm/xe/shrinker: Take a runtime PM ref before shrinking non-system memory xeshrinkerwalk walks the SYSTEM and TT LRUs without a runtime PM reference. Shrinking a bo outside system memory invalidates its GPU mappings, which needs...