CVE-2026-98544

The Linux kernel contains a vulnerability where the bnad_pci_remove() and probe disable_ioceth paths fail to properly handle the iocpf_timer . While other timers are removed via timer_delete_sync() , the iocpf_timer remains active, leading bnad_iocpf_timeout() to attempt to take the bnad->bna_...

EUVD-2026-103589

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98544 bna: prevent IOC timer rearm during teardown

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98543

A flaw in the Linux kernel BPF subsystem allows a local privileged user to cause a Denial of Service (DoS) or file system corruption . The issue stems from improper locking where the kernel verifier incorrectly assumes an inode lock is held during certain file removal hooks (path_unlink and path_...

EUVD-2026-103588

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

CVE-2026-98543 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

CVE-2026-98542 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98543 bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir

In the Linux kernel, the following vulnerability has been resolved: bpf: fs/xattr: don't assume the inode is locked in pathunlink/pathrmdir bpflsmhasdinodelocked makes the verifier rewrite bpfset|removedentryxattr to the locked variants, which assume that the caller already holds the inode's...

EUVD-2026-103587

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98542 cgroup/cpuset: Return PERR_NOCPUS in remote_partition_enable() on subpartitions_cpus conflict

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Return PERRNOCPUS in remotepartitionenable on subpartitionscpus conflict When a remote partition is created underneath an existing local partition via a non-partition PRSMEMBER intermediate cgroup, updateprstate se...

CVE-2026-98542

The Linux kernel is affected by a vulnerability in cgroup/cpuset where the remote_partition_enable() function fails to properly handle subpartitions_cpus conflicts. Specifically, when a remote partition is created under an existing local partition via a non-partition intermediate cgroup, the kern...

EUVD-2026-103586

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98541

The Linux kernel contains a vulnerability where omitting the FOU_ATTR_IPPROTO attribute when sending a FOU_CMD_ADD request with FOU_ENCAP_DIRECT causes fou_create() to initialize the protocol to 0. Because fou_udp_recv() returns 0 when the protocol is 0, it informs the UDP tunnel layer that the s...

CVE-2026-98541 fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT

In the Linux kernel, the following vulnerability has been resolved: fou: reject omitted FOUATTRIPPROTO on FOUENCAPDIRECT Commit 7a9bc9e3f423 "fou: Don't allow 0 for FOUATTRIPPROTO." added NLAPOLICYMINNLAU8, 1 to founlpolicyFOUATTRIPPROTO, which rejects an explicitly supplied FOUATTRIPPROTO == 0...

CVE-2026-98540

The Linux kernel contains a vulnerability where fprobe_fgraph_entry() reserves shadow stack space but fails to clear the area if the entry handler does not return 0. This allows fprobe_return() to incorrectly parse unused tail data as headers from previous calls, potentially causing an exit handl...

CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

EUVD-2026-103585

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

CVE-2026-98540 fprobe: Terminate the fgraph_data list when the reservation is not filled

In the Linux kernel, the following vulnerability has been resolved: fprobe: Terminate the fgraphdata list when the reservation is not filled fprobefgraphentry reserves shadow stack space for every fprobe with an exit handler, but only fills it for those whose entry handler returns 0...

CVE-2026-98539

The Linux kernel 's ntfs3 filesystem component contains a vulnerability where ntfs_create_inode() incorrectly interacts with d_instantiate() . Specifically, calling unlock_new_inode() after d_instantiate() causes lockdep_annotate_inode_mutex_key() to reset the i_rwsem count and owner while anothe...