CVE-2026-98252 RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

CVE-2026-98252

The Linux kernel contains a refcount bug in the RDMA/core component within the iwpm_get_nlmsg_request() function. The vulnerability is caused by the function initializing the refcount after calling list_add_tail(), which allows another CPU to access the global list and perform a kref_get() on the...

CVE-2026-98252 RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

EUVD-2026-93180

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

CVE-2026-98250 nfsd: fix handling of NFSEXP_PNFS in the netlink codepath

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

EUVD-2026-93179

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98251

The Linux kernel is vulnerable in the openvswitch component due to an issue in ovs_ct_get_conn_labels(). The function incorrectly adds a labels extension to confirmed conntracks that lack one. Because confirmed conntracks can be read locklessly, adding this extension may trigger a reallocation an...

EUVD-2026-93178

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

CVE-2026-98250

The Linux kernel contains a vulnerability in nfsd related to the handling of NFSEXP_PNFS within the netlink codepath . The issue arose because a previous rework of block layout checks moved the NFSEXP_PNFS check out of nfsd4_setup_layout_type() into its callers, but that patch failed to account f...

CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98249 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

CVE-2026-98249 arm64: hibernate: pass HVC_SET_VECTORS args to the resume hvc

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

EUVD-2026-93177

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

CVE-2026-98249

The Linux kernel contains a vulnerability in the arm64 architecture during hibernation. The function swsusp_arch_suspend_exit() fails to pass the required arguments for HVC_SET_VECTORS when reinstalling the restored kernel's hyp stub vectors. Because x0 and x1 registers are not correctly set, the...

CVE-2026-98248 arm64: percpu: Fix LSE operations on {8,16}-bit types

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...

CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

EUVD-2026-93176

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...

CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

CVE-2026-98248 arm64: percpu: Fix LSE operations on {8,16}-bit types

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...