CVE-2026-98507

The Linux kernel is susceptible to a race condition in the mm/rmap component on arm64 servers. The vulnerability exists because a missing memory barrier between the initialization of anon_vma and its publication to vma->anon_vma allows for memory reordering. Specifically, a thread can observe ...

CVE-2026-98506 mm/hugetlb: do not dissolve gigantic pages without runtime support

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

CVE-2026-98506

The Linux kernel contains a vulnerability in the mm/hugetlb component where the dissolve_free_hugetlb_folio() function fails to check hstate_is_gigantic_no_runtime(h). Because remove_hugetlb_folio() and update_and_free_hugetlb_folio() silently bail for such folios, the system may free a folio tha...

CVE-2026-98506 mm/hugetlb: do not dissolve gigantic pages without runtime support

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

EUVD-2026-103746

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

CVE-2026-98506

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

CVE-2026-98505 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

EUVD-2026-103745

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

CVE-2026-98505

The Linux kernel contains a bug in the damon_hugetlb_mkold() function where reading a page table entry (PTE) into a local variable to unset the accessed bit can lead to lost hardware updates . If hardware updates the same PTE in parallel, changes like dirty bits might be overwritten and lost. The...

CVE-2026-98505 mm/damon/vaddr: avoid hw-driven pte updates during damon_hugetlb_mkold()

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

CVE-2026-98504 PCI: of_property: Omit bus properties without a subordinate bus

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

EUVD-2026-103744

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98504 PCI: of_property: Omit bus properties without a subordinate bus

In the Linux kernel, the following vulnerability has been resolved: PCI: ofproperty: Omit bus properties without a subordinate bus A bridge a device with a Type 1 header may not have a secondary bus allocated pdev-subordinate, e.g., if there are no available bus numbers or the bridge...

CVE-2026-98504

The Linux kernel contains a vulnerability where the dynamic OF helpers of_pci_prop_bus_range() and of_pci_prop_intr_map() dereference pdev->subordinate without a prior check. This occurs when a bridge device (Type 1 header) lacks an allocated secondary bus, such as when bus numbers are unavail...

CVE-2026-98503 packet: use ubuf_info completion for TX_RING packets

In the Linux kernel, the following vulnerability has been resolved: packet: use ubufinfo completion for TXRING packets tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skborphan calls skb-destructor before the skb is freed...

EUVD-2026-103743

In the Linux kernel, the following vulnerability has been resolved: packet: use ubufinfo completion for TXRING packets tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skborphan calls skb-destructor before the skb is freed...

CVE-2026-98503

The Linux kernel contains a vulnerability in the packet subsystem where tpacket_snd sends skbs with fragments pointing into ring slots. A call to skb_orphan could trigger skb->destructor before the skb is freed, leading to the premature reuse of a slot while it is still linked to the skb. To r...

CVE-2026-98503 packet: use ubuf_info completion for TX_RING packets

In the Linux kernel, the following vulnerability has been resolved: packet: use ubufinfo completion for TXRING packets tpacketsnd sends skbs with frags pointing into its ring slots. Slots are released when skb-destructor is called. A call to skborphan calls skb-destructor before the skb is freed...

CVE-2026-98434

In the Linux kernel, the following vulnerability has been resolved: sysctl: Check range in procdointvecmsjiffiesminmax Add the range check to doprocintconvmsjiffiesminmax that commit d174174c6776 "sysctl: replace SYSCTLINTCONVCUSTOM macro with functions" incorrectly removed...

CVE-2026-98433

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix secure device page leak on uvpagein failure In kvmppcsvmpagein, if uvpagein fails after kvmppcuvmemgetpage has succeeded, the secure device page is never released. kvmppcuvmemgetpage sets a bit in...