CVE-2026-98517

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/uvmm: fix UAF in nouveauuvmmsm when BO is in TTMPLSYSTEM nouveauuvmmsm calls opmap, which passes bo-resource through nouveaumem to nouveauuvmamap. nouveauuvmmvmmmap then reads mem-mem.type. But this is only valid when...

CVE-2026-98508

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98512

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: RCU-free the scheduler-containing nouveausched struct nouveausched embeds a struct drmgpuscheduler base. nouveauscheddestroy calls nouveauschedfini which does drmschedfini&sched-base and then frees the object with...

CVE-2026-98565

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98556

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gvepreptso notes that the device requires the MSS to be len and gsosegs, never gsosize. Such a packet reaches gvetxfilltsoctxdesc, which puts gsosize into the mss field of the...

CVE-2026-98502

In the Linux kernel, the following vulnerability has been resolved: HID: alps: unregister DualPoint Stick input device on remove alpsinputconfigured allocates a second input device "DualPoint Stick" with inputallocatedevice and registers it, but the alpsdriver struct has no .remove handler and...

CVE-2026-98536

In the Linux kernel, the following vulnerability has been resolved: writeback: report a Tasks-RCU quiescent state per cgwb drain pass cleanupofflinecgwbsworkfn drains a dying cgwb by calling cleanupofflinecgwb until it returns false, with a condresched between passes. On a CONFIGPREEMPTION kernel...

CVE-2026-98519

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Fix runtime PM leak in amdgpudebugfstestibshow amdgpudebugfstestibshow resumes the device with pmruntimegetsync before taking the reset domain semaphore with downwritekillable. If the write lock acquisition is...

CVE-2026-98509

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix memory leak of fence event on execbuffer failure virtiogpuexecbufferioctl reserves a DRM event with drmeventreserveinit when VIRTGPUEXECBUFRINGIDX selects a ring that userspace has enabled polling for...

CVE-2026-98525

In the Linux kernel, the following vulnerability has been resolved: mctp: route: iterate socket tag list in mctplookupprealloctag When a socket transmits a packet with MCTPTAGPREALLOC set, mctplookupprealloctag iterates over the per-netns &mns-keys list and matches netid, reqtag, peeraddr, and...

CVE-2026-98505

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

CVE-2026-98515

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: fix double-free in nvifvmmdtor On failure, nouveaucliinit calls nouveauclifini to tear the client down. Then, nouveaudrmopen also enters into its cleanup path and calls nouveauclifini AGAIN. nouveauclifini calls...

CVE-2026-98503

In the Linux kernel, the following vulnerability has been resolved: packet: use ubufinfo completion for TXRING packets tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skborphan calls skb-destructor before the skb is freed...

CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98501

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

CVE-2026-98527

In the Linux kernel, the following vulnerability has been resolved: gpio: zynq: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and zynqgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-98524

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap unpins the pages and frees the scatterlist, but...

CVE-2026-98535

In the Linux kernel, the following vulnerability has been resolved: fsl/fman: Fix clk reference leak in readdtsnode ofclkget returns a clock with its reference count incremented, but readdtsnode only uses it to read the rate and never calls clkput. The clock is not stored anywhere, so the referen...

CVE-2026-98504

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98538

In the Linux kernel, the following vulnerability has been resolved: writeback: bound cleanupofflinecgwb rescans by rotating scanned inodes cleanupofflinecgwb prepares at most WBMAXINODESPERISW inodes per call and is called again until the dying wb is drained, but every call walks wb-battached and...