CVE-2026-98150

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix BPFFCPU validation for sparse CPU IDs BPFFCPU stores the target CPU ID in the upper 32 bits of the map operation flags. bpfmapcheckopflags currently compares that ID with numpossiblecpus, which is the number of possible...

CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

CVE-2026-98133

In the Linux kernel, the following vulnerability has been resolved: ntfs: leave HasEA flag untouched on setxattr failure In ntfssetea, the exit path unconditionally updates the HasEA flag based on eainfoqsize. When an error occurs before eainfoqsize is updated, NInoClearHasEA hides existing on-di...

CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

CVE-2026-98070

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98159

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7921: validate CLC firmware records The CLC region is supplied by firmware, but the loader trusts the region count and each record length. A malformed image can make the region table pointer precede the firmware...

CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-98029

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: bound the ntuple rule dump by the caller's buffer size nfpnetgetfsloc dumps every entry of nn-fs.list into rulelocs without consulting cmd-rulecnt, which is how many entries the caller had room for. ETHTOOLGRXCLSRLALL...

CVE-2026-98110

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98052

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98069

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

CVE-2026-98041

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't predict JMP32 pointer vs zero comparisons Consider the following program: r1 = mapvalue; / low 32 bits are zero at runtime / r6 = 0xdead000000000000; if w1 != 0 goto l1; l0: r1 += r6; r2 = u64 r1 + 0; exit; l1: r6 = 0;...

CVE-2026-98023

In the Linux kernel, the following vulnerability has been resolved: vxlan: reject dynamic fdb entries that reference a nexthop id The commit cited in the Fixes tag allowed VXLAN FDB entries to point to FDB nexthops so that overlay traffic could be load balanced across multiple VTEPs. Such entries...

CVE-2026-97941

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

CVE-2026-97991

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

CVE-2026-97938

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid reads it and passes it to pidvnr without protecting the lifetime of the referenced struct pid. A concurrent writer can replace...

CVE-2026-97618

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

CVE-2026-98074

In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curractiveslave prematurely when releasing all slaves When releasing all slaves during bond destruction all == true, bondreleaseone unconditionally clears bond-curractiveslave to NULL in every iteration. If ...

CVE-2026-97557

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...