CVE-2026-98553 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

CVE-2026-98553 autofs: fix sbi->pipe file reference leak in autofs_kill_sb()

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

CVE-2026-98553

The Linux kernel contains a vulnerability in the autofs component where a pipe struct file reference is permanently leaked. This occurs when autofs_fill_super() fails before clearing the AUTOFS_SBI_CATATONIC flag—specifically during find_get_pid() failures on invalid pgrp mount options or when an...

EUVD-2026-103598

In the Linux kernel, the following vulnerability has been resolved: autofs: fix sbi-pipe file reference leak in autofskillsb When autofsfillsuper fails before clearing AUTOFSSBICATATONIC for example, when findgetpid fails on an invalid pgrp mount option, or when an fscontext is closed before...

CVE-2026-98551

The Linux kernel contains a vulnerability in the perf/core component specifically affecting the arm64 architecture. The issue arises because perf_clear_branch_entry_bitfields() failed to clear the new_type and priv bitfields in struct perf_branch_entry. Because arm_pmuv3.c allocates the per-CPU b...

CVE-2026-98552

The Linux kernel contains a reference count leak in the perf/core component within the attach_perf_ctx_data() function. The vulnerability stems from a race condition between global and !global cases. When these cases race, the system may fail to set the global field, leading to a reference count ...

CVE-2026-98551 perf/core: Fill branch entries with a single assignment

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

CVE-2026-98552 perf/core: Fix a refcount leak in attach_perf_ctx_data()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

EUVD-2026-103596

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

EUVD-2026-103597

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98552 perf/core: Fix a refcount leak in attach_perf_ctx_data()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98551 perf/core: Fill branch entries with a single assignment

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98550

The Linux kernel contains a vulnerability in the tipc transport protocol where an incomplete check on GRP_ACK_MSG allows for bc_ackers underflow. Specifically, if grp->bc_ackers is zero, an unexpected ACK with a higher sequence number can wrap the 16-bit counter to 65535, causing tipc_group_bc...

EUVD-2026-103595

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

EUVD-2026-103594

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549

A vulnerability in the Linux kernel TCP stack allows skbs to be improperly collapsed across a boundary in the rtx queue . The issue occurs because tcp_write_collapse_fence() can be a no-op if the sk_write_queue is empty, leading tcp_retrans_try_collapse() or tcp_shift_skb_data() to merge new skbs...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...