CVE-2026-98833 mtd: core: call _get_device() with the master MTD

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

EUVD-2026-103773

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

CVE-2026-98833

The Linux kernel contains a vulnerability in the mtd core where __get_mtd_device() incorrectly calls the master's _get_device() callback using the mtd (which may be a partition) instead of the master itself. This inconsistency breaks gluebi partitions because gluebi_get_device() requires the mast...

CVE-2026-98833 mtd: core: call _get_device() with the master MTD

In the Linux kernel, the following vulnerability has been resolved: mtd: core: call getdevice with the master MTD getmtddevice calls the master's getdevice callback with mtd, which may be a partition. putmtddevice passes the master. This breaks gluebi partitions because gluebigetdevice uses...

CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

EUVD-2026-103772

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98832

The Linux kernel contains a vulnerability in the blk-cgroup subsystem where the function blkg_tryget_closest() uses spin_lock_irq() and spin_unlock_irq() to manage q->queue_lock. Because spin_unlock_irq() unconditionally enables local interrupts, it can cause a deadlock when called by function...

CVE-2026-98832 blk-cgroup: save IRQ state in blkg_tryget_closest()

In the Linux kernel, the following vulnerability has been resolved: blk-cgroup: save IRQ state in blkgtrygetclosest biosetdev associates the bio with a blkg through bioassociateblkg. If the blkg lookup misses, blkgtrygetclosest takes q-queuelock with spinlockirq and releases it with spinunlockirq...

CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

CVE-2026-98831

The Linux kernel contains a memory leak vulnerability in the of/overlay component. During the execution of init_overlay_changeset(), if find_target() or the __symbols__ lookup fails mid-process, the target and overlay references for fragments initialized up to that point are not released. This oc...

CVE-2026-98831 of/overlay: don't leak fragment references when changeset init fails

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

EUVD-2026-103771

In the Linux kernel, the following vulnerability has been resolved: of/overlay: don't leak fragment references when changeset init fails initoverlaychangeset stores the number of initialized fragments in ovcs-count only on full success. When findtarget or the symbols lookup fails partway through,...

CVE-2026-98830

The Linux kernel contains a vulnerability in the wifi: wfx component. The function wfx_hif_read_mib() fails to validate that the reply->length from a firmware response does not exceed the val_len of the caller-provided buffer. This lack of bounds checking allows a firmware response with an ove...

EUVD-2026-103770

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98830 wifi: wfx: validate MIB read length before copying to caller

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98830 wifi: wfx: validate MIB read length before copying to caller

In the Linux kernel, the following vulnerability has been resolved: wifi: wfx: validate MIB read length before copying to caller wfxhifreadmib copies reply-length bytes from the firmware response into the caller-provided buffer without checking that reply-length does not exceed vallen. A firmware...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

EUVD-2026-103769

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829

The Linux kernel contains a vulnerability in the mac80211 component where oversized fragments can cause an extra_len overflow . The root cause is that entry->extra_len was narrowed from unsigned int to u16 to reduce memory footprint. When a sequence of large fragments exceeds 65535 bytes, the ...