CVE-2026-98227 memstick: ms_block: destroy io_queue workqueue on removal

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: destroy ioqueue workqueue on removal msbinitdisk creates the per-card ordered workqueue msb-ioqueue with allocorderedworkqueue. It is torn down with destroyworkqueue only on the init error path; msbremove never...

CVE-2026-98226

The Linux kernel contains a vulnerability where the SWAP_USAGE_OFFLIST_BIT collides with the real usage count because it is defined as bit 30 of an atomic_t type. On systems with 4 KiB pages, this collision occurs once the count reaches 4 TiB . This leads to several issues: /proc/swaps understate...

EUVD-2026-93154

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

CVE-2026-98226 mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

CVE-2026-98226 mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...

CVE-2026-98225

The Linux kernel contains a vulnerability in the mm/shrinker component related to the cgroup.memory=nokmem configuration. When nokmem is active, shrinker_memcg_alloc() bails out early, causing shrinker->id to retain a default value of 0 from kzalloc(). This value is then incorrectly treated as...

EUVD-2026-93153

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus setshrinkerbit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinkermemcgalloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinkeralloc...

CVE-2026-98225 mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus setshrinkerbit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinkermemcgalloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinkeralloc...

CVE-2026-98225 mm/shrinker: fix bogus set_shrinker_bit() with cgroup.memory=nokmem

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: fix bogus setshrinkerbit with cgroup.memory=nokmem With cgroup.memory=nokmem, shrinkermemcgalloc bails out early and never allocates an id, so shrinker-id keeps the 0 it got from the kzalloc in shrinkeralloc...

EUVD-2026-93152

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98224 mm/vma: correctly unaccount on mmap_prepare() failure

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98224 mm/vma: correctly unaccount on mmap_prepare() failure

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98224

The Linux kernel contains a memory accounting flaw in the mm/vma component. When call_mmap_prepare() fails, the system incorrectly jumps to abort_munmap without properly uncounting memory that was previously accounted for during __mmap_setup() via vm_acct_memory() . This could lead to inaccurate ...

CVE-2026-98223

The Linux kernel contains a vulnerability where Fault-around can map ready dropbehind folios without undergoing the standard page-cache lookup. Because a mapping represents a competing cached user, the system should retain the folio rather than forcibly unmapping it upon writeback completion. If ...

CVE-2026-98223 mm: filemap: retain mapped dropbehind folios

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

EUVD-2026-93151

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

CVE-2026-98223 mm: filemap: retain mapped dropbehind folios

In the Linux kernel, the following vulnerability has been resolved: mm: filemap: retain mapped dropbehind folios Fault-around can map ready dropbehind folios without going through the normal page-cache lookup that clears dropbehind. A mapping represents a competing cached user, so retain the foli...

CVE-2026-98222

The Linux kernel contains an integer overflow vulnerability in the KEYS: encrypted subsystem. The function encrypted_key_alloc() stores datablob_len in a u16 variable. When the sum of various string and payload lengths exceeds U16_MAX , the allocation size is truncated, leading to a slab-out-of-b...

CVE-2026-98222 KEYS: encrypted: fix integer overflow of datablob_len

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...

CVE-2026-98222 KEYS: encrypted: fix integer overflow of datablob_len

In the Linux kernel, the following vulnerability has been resolved: KEYS: encrypted: fix integer overflow of databloblen encryptedkeyalloc stores databloblen in a u16. It is computed from multiple string and payload lengths. If the result exceeds U16MAX, the assignment truncates the allocation...