CVE-2026-98285

The Linux kernel contains a vulnerability in the net: bridge: vlan component where switchdev could prevent vlan deletion and trigger errors in __vlan_del. This flaw can lead to inconsistent states , memory leaks , and a NULL pointer dereference during bridge flushing. The fix involves logging the...

EUVD-2026-93212

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

CVE-2026-98284

The Linux kernel contains a vulnerability where netlink_realloc_groups() uses krealloc() to reallocate the nlk->groups bitmap. If the new size falls into a different kmalloc bucket , the old bitmap is freed immediately while lockless readers—specifically sk_diag_dump_groups() and netlink_nativ...

EUVD-2026-93211

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

CVE-2026-98283

The Linux kernel contains a use-after-free vulnerability in the KVM subsystem specifically for PPC: Book3S HV hardware. The issue exists in kvmhv_emulate_tlbie_all_lpid(), where the function iterates the nested-guest IDR and drops the mmu_lock without holding a reference on the kvm_nested_guest p...

CVE-2026-98282

The Linux kernel contains a vulnerability in the powerpc/iommu component related to iommu_tce_check_ioba. The issue arose because a previous commit unified IOBA parameter checking but ignored the npages argument, using a constant value of '1' instead. This omission could lead to an arithmetic ove...

CVE-2026-98282 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

EUVD-2026-93210

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

EUVD-2026-93209

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98281 futex: Also allocate private hash on vfork()

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98281

The Linux kernel contains a vulnerability where a private hash must be allocated during a vfork() system call, similar to other CLONE_VM users. This is necessary because it is feasible to access the mm (memory management) through vfork(). The issue specifically requires ensuring that (private) fu...

CVE-2026-98279

The Linux kernel contains a vulnerability in the btrfs filesystem where a lack of space or a qgroup limit during the cleanup of verity items can cause the entire filesystem to be forced into read-only mode. This occurs because rollback_verity() requires its own metadata reservation; if denied, th...

CVE-2026-98280 drm/xe/i2c: Disable IRQ on unbind

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xei2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xei2cremove a...

EUVD-2026-93207

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

EUVD-2026-93208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xei2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xei2cremove a...

CVE-2026-98280

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the drm/xe/i2c component. The issue occurs because struct xe_i2c is freed before the SGUnit IRQ is disabled during the unbind path. This creates a small window where the I2C IRQ could be triggered while the structure is already...

CVE-2026-98280

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xei2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xei2cremove a...

CVE-2026-98278

The Linux kernel contains a logic issue where dev_fill_forward_path() triggers a WARN_ON_ONCE warning when a flowtable attempts to offload a flow through a tunnel that resolves back to itself. This routing loop can be configured by any user with CAP_NET_ADMIN privileges. Because ip_tunnel_xmit() ...

EUVD-2026-93206

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from the devfillforwardpath loop check ipipfillforwardpath and ip6tnlfillforwardpath look up the route to the tunnel's remote endpoint and set ctx-dev to its device, which is the tunnel itself when that rou...

CVE-2026-98277

The Linux kernel contains a vulnerability in the fbnic driver where the fbnic_tx_map() function fails to ring the doorbell or issue a completion request for packets in a burst if the final packet in that burst is dropped (e.g., due to skb_put_padto(), skb_cow_head(), or a DMA mapping failure). Th...