PT-2026-106666

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't start a ROC while scanning The ROC work can be pending when a scan starts which requires ROC list to be empty, but that's possible, and then a new ROC can be added to the list and the work will pick it up...

PT-2026-106651

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft nat: fully initialise new addr in netmap setup nft nat setup netmap builds the mapped address in an on-stack union nf inet addr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single...

PT-2026-106660

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: unlist vifs when their netdev is unregistered mac80211 only removes vifs from the local-interfaces list when an interface is removed via ieee80211 if remove, before it unregisters the netdev. However, it's possibl...

CVE-2026-98239: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

CVE-2026-98262: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCIHFLAG32BITONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as so...

PT-2026-106608

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enable verity hits the qgroup limit, rollback verity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole...

PT-2026-106591

In the Linux kernel, the following vulnerability has been resolved: ata: libahci: clear PxCLBU and PxFBU for AHCI HFLAG 32BIT ONLY A user reported that commit 105c42566a55 "ata: ahci: force 32-bit DMA for JMicron JMB582/JMB585" made the JMicron JMB585 unusable on his board. The failure is seen as...

PT-2026-106518

In the Linux kernel, the following vulnerability has been resolved: wifi: wilc1000: fix RX buffer OOB-write in wilc wlan handle isr ext wilc wlan handle isr ext takes the RX transfer size from the device-reported interrupt status register a 15-bit field shifted left by 2, up to 131068 bytes and...

PT-2026-106568

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743x rx process buffer adds each non-first receive buffer to the head skb's frag list. On the last descriptor, lan743x rx trim skb linearizes the head and frees the fragment skb...

PT-2026-106577

In the Linux kernel, the following vulnerability has been resolved: arm64: percpu: Fix LSE operations on 8,16-bit types The assembly for percpu name case sz and percpu name return case sz doesn't use the 'sfx' macro argument to form the LSE instruction. Without 'sfx', a W register argument will...

PT-2026-106594

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity data ep set params allocates each data URB for exactly u-packets isochronous frames, so urb-iso frame desc has u-packets slots and ctx-packets is the driver's...

PT-2026-106583

In the Linux kernel, the following vulnerability has been resolved: swiotlb: use the adjusted address for the highmem page lookup swiotlb bounce reads the page frame number from the slot's recorded orig addr, then advances orig addr by tlb offset to reach the address the caller asked about. The...

PT-2026-106635

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKB L3SLAVE from IP6SKB L3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrf ip6 rcv sets IP6SKB L3SLAVE in IP6CB, but decap and validate has never set IPSKB L3SLAVE in IPCB...

CVE-2026-98201: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: zero ffeffect before compat copy in inputffeffectfromuser In the compat path inputffeffectfromuser aliases the caller's native struct ffeffect with the smaller struct ffeffectcompat and copies only the compat sized prefix:...

CVE-2026-98203: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: socbuttonarray - check btnsdesc-package.count Check that btnsdesc-package.count is not 0 before accessing btnsdesc-package.elements0...

CVE-2026-98206: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Input: cyttsp5 - clamp the HID report size before memcpy The size field comes from the device and is used as the memcpy length into responsebuf, which is CYMAXINPUT bytes...

CVE-2026-98224: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: mm/vma: correctly unaccount on mmapprepare failure mmapsetup accounts memory for relevant mappings via: securityvmenoughmemorymm - vmenoughmemory - vmacctmemory If mmapsetup fails, this indicates that this accounting did not take...

CVE-2026-98289: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: afunix: Unify sccindex when finalising SCC in unixwalkscc. Commit bfdb01283ee8 "afunix: Assign a unique index to SCC." changed Tarjan's algorithm to update lowlink with lowlink, which is called lowpoint unixvertex.sccindex...

PT-2026-106600

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskb carve pskb carve inside header and pskb carve inside nonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the...

PT-2026-106569

In the Linux kernel, the following vulnerability has been resolved: net: ip tunnel: initialize options len before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 encap ip id 300 geneve opts 4660:66:11223344...