CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

EUVD-2026-103965

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98711

The Linux kernel contains a vulnerability in the wifi: cw1200 driver where the TX path rounds the transfer size up to the bus alignment (up to 511 bytes for SDIO, 1 byte for SPI) but fails to reserve room in the frame buffer for the padding. This causes cw1200_data_write() to perform an out-of-bo...

EUVD-2026-103966

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

CVE-2026-98711 wifi: cw1200: fix TX padding OOB read leaking heap data to device

In the Linux kernel, the following vulnerability has been resolved: wifi: cw1200: fix TX padding OOB read leaking heap data to device The TX path rounds the transfer size up to the bus alignment alignsize, up to 511 bytes for SDIO, 1 byte for SPI but sends the padded length straight from the fram...

CVE-2026-98710

The Linux kernel contains a memory leak vulnerability in the wifi: iwlegacy: 3945 driver. Specifically, while the il3945_pci_probe() function calls il_eeprom_init() to allocate memory for EEPROM data, the remove path fails to release this memory after a successful probe. This results in EEPROM da...

EUVD-2026-103964

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98710 wifi: iwlegacy: 3945: free EEPROM data on remove

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlegacy: 3945: free EEPROM data on remove il3945pciprobe calls ileeprominit, which allocates memory for the EEPROM data. The probe failure paths release this allocation with ileepromfree, but the remove path does not free ...

CVE-2026-98709

A vulnerability exists in the Linux kernel 's wifi: mac80211 component. The function ieee80211_vif_use_reserved_switch() incorrectly validates replacements by counting assigned links too broadly, allowing a link to remain assigned to an old channel context while holding a reservation for a differ...

CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

EUVD-2026-103963

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

CVE-2026-98709 wifi: mac80211: count only matching reservations in reserved switch

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: count only matching reservations in reserved switch ieee80211vifusereservedswitch validates a replacement by counting assigned links on ctx-replacectx and treating reservations too broadly. A link can still be...

CVE-2026-98708

The Linux kernel contains a vulnerability in the wifi: mac80211 component where a chanctx (channel context) could be freed prematurely. The issue occurs because early free paths only consider assigned and reserved link users, allowing an old WILL_BE_REPLACED chanctx to be freed while its replacem...

CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

EUVD-2026-103962

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

CVE-2026-98708 wifi: mac80211: keep paired old chanctx alive

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: keep paired old chanctx alive An in-place replacement keeps reciprocal replacectx pointers between the old WILLBEREPLACED chanctx and the new REPLACESOTHER chanctx. However, the early free paths only consider...

CVE-2026-98707 wifi: mac80211: shut down RX BA session timer on teardown

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...

EUVD-2026-103961

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: shut down RX BA session timer on teardown Tearing down an RX BA session can leave the session timer queued on a freed tidrx. Later timer-wheel processing and the timer callback itself then run against freed memory...