CVE-2026-98245 btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

EUVD-2026-93173

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

CVE-2026-98245 btrfs: take commit root semaphore when iterating in mark_block_group_to_copy()

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...

CVE-2026-98244 btrfs: clear free space tree creation state on rebuild failure

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

EUVD-2026-93172

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98244

The Linux kernel btrfs filesystem contains a vulnerability where the btrfs_rebuild_free_space_tree() function fails to clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on certain error paths. Specifically, a transaction restart failure can leave this flag set on a live filesystem, which results i...

CVE-2026-98245

The Linux kernel contains a vulnerability in the btrfs filesystem. The function mark_block_group_to_copy() iterates over the commit root while skip_locking is set to true. This allows a concurrent transaction commit to swap and free the commit root during iteration, resulting in a use-after-free ...

CVE-2026-98243

A vulnerability exists in the Linux kernel 's dma-buf/dma-fence component. A previous patch intended to prevent a NULL pointer dereference by testing the ops pointer instead of the signaled bit inadvertently removed RCU protection for many dma_fence implementations. This loss of protection can le...

CVE-2026-98243 dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98243 dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

EUVD-2026-93171

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98242 dma-buf: Fix silent overflow for phys vec to sgt

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

EUVD-2026-93170

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98242 dma-buf: Fix silent overflow for phys vec to sgt

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98242

A vulnerability in the Linux kernel dma-buf subsystem allows for a silent overflow when the MMIO size exceeds 4G during peer-to-peer DMA through a host bridge. The root cause is that mapped_len was declared as a 32-bit unsigned int, causing a wrap-around when accumulating size_t lengths. This tru...

CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98240

The Linux kernel contains a vulnerability in the net: ip_tunnel component where options_len is used to calculate an option pointer before being initialized. This oversight leads to a buffer overflow during a memcpy operation, specifically when processing geneve_opts . This issue can trigger a ker...

CVE-2026-98241 ipv6: xfrm: use full sockets in local error paths

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

CVE-2026-98241 ipv6: xfrm: use full sockets in local error paths

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...