CVE-2026-98252

The Linux kernel contains a refcount bug in the RDMA/core component within the iwpm_get_nlmsg_request() function. The vulnerability is caused by the function initializing the refcount after calling list_add_tail(), which allows another CPU to access the global list and perform a kref_get() on the...

CVE-2026-98252 RDMA/core: fix refcount bug in iwpm_get_nlmsg_request()

In the Linux kernel, the following vulnerability has been resolved: RDMA/core: fix refcount bug in iwpmgetnlmsgrequest iwpmgetnlmsgrequest initializes refcount after listaddtail making it accessible to global list where another CPU can krefget on nlmsgrequest causing a refcount "addition on 0" bu...

CVE-2026-98250

The Linux kernel contains a vulnerability in nfsd related to the handling of NFSEXP_PNFS within the netlink codepath . The issue arose because a previous rework of block layout checks moved the NFSEXP_PNFS check out of nfsd4_setup_layout_type() into its callers, but that patch failed to account f...

EUVD-2026-93179

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98251

The Linux kernel is vulnerable in the openvswitch component due to an issue in ovs_ct_get_conn_labels(). The function incorrectly adds a labels extension to confirmed conntracks that lack one. Because confirmed conntracks can be read locklessly, adding this extension may trigger a reallocation an...

CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

EUVD-2026-93178

In the Linux kernel, the following vulnerability has been resolved: nfsd: fix handling of NFSEXPPNFS in the netlink codepath The rework of how block layouts were checked moved the check for NFSEXPPNFS out of nfsd4setuplayouttype and into the callers. That patch didn't account for the new call in...

CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98249

The Linux kernel contains a vulnerability in the arm64 architecture during hibernation. The function swsusp_arch_suspend_exit() fails to pass the required arguments for HVC_SET_VECTORS when reinstalling the restored kernel's hyp stub vectors. Because x0 and x1 registers are not correctly set, the...

EUVD-2026-93177

In the Linux kernel, the following vulnerability has been resolved: arm64: hibernate: pass HVCSETVECTORS args to the resume hvc swsusparchsuspendexit reinstalls the restored kernel's hyp stub vectors with an hvc, but never passes the arguments. x0 is not set to HVCSETVECTORS and x1 is not set to...

CVE-2026-98248

The Linux kernel contains a vulnerability in the arm64 architecture regarding percpu operations. Specifically, the assembly for __percpu_##name##_case_##sz() and __percpu_##name##_return_case_##sz() fails to use the 'sfx' macro argument when forming LSE instructions . This omission causes {8,16}-...

CVE-2026-98247

The Linux kernel contains a vulnerability in the Bluetooth hci_codec component. The Read Local Supported Codecs parsers incorrectly consume variable-sized standard codec arrays before parsing the vendor codec count. Because the initial reply-size check does not guarantee the vendor count byte rem...

EUVD-2026-93175

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...

EUVD-2026-93176

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpunamecasesz and percpunamereturncasesz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will imply a...

CVE-2026-98246

A use-after-free vulnerability exists in the Linux kernel Bluetooth stack within the hci_sync component. The hci_dev_close_sync() function clears the hdev->local_codecs list after releasing the hdev->lock, whereas additions and traversals in sco_sock_getsockopt() correctly acquire this lock...

EUVD-2026-93174

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Serialize local codec list cleanup hcidevclosesync clears hdev-localcodecs after releasing hdev-lock. Codec list additions and both traversals in scosockgetsockopt use that lock, but the close path does not. A...

CVE-2026-98245

The Linux kernel contains a vulnerability in the btrfs filesystem. The function mark_block_group_to_copy() iterates over the commit root while skip_locking is set to true. This allows a concurrent transaction commit to swap and free the commit root during iteration, resulting in a use-after-free ...

EUVD-2026-93172

In the Linux kernel, the following vulnerability has been resolved: btrfs: clear free space tree creation state on rebuild failure btrfsrebuildfreespacetree sets BTRFSFSCREATINGFREESPACETREE before rebuilding the free space tree. Several error paths return without clearing this flag. The...

CVE-2026-98244

The Linux kernel btrfs filesystem contains a vulnerability where the btrfs_rebuild_free_space_tree() function fails to clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on certain error paths. Specifically, a transaction restart failure can leave this flag set on a live filesystem, which results i...

EUVD-2026-93173

In the Linux kernel, the following vulnerability has been resolved: btrfs: take commit root semaphore when iterating in markblockgrouptocopy markblockgrouptocopy iterates over the commit root with skiplocking=true. A concurrent transaction commit can swap and free the commit root during iteration...