CVE-2026-98605 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98605 drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach

In the Linux kernel, the following vulnerability has been resolved: drm/bridge: samsung-dsim: fix TE GPIO lifetime for host attach When the Exynos DSI driver was generalized into samsung-dsim, the TE GPIO acquisition was switched from gpiodgetoptional to devmgpiodgetoptional while keeping the...

CVE-2026-98605

The Linux kernel contains a vulnerability in the drm/bridge: samsung-dsim driver related to improper TE GPIO lifetime management during host attach. The issue arose when the Exynos DSI driver was generalized into samsung-dsim , incorrectly mixing managed descriptors (devm_gpiod_get_optional()) wi...

CVE-2026-98598

The Linux kernel contains an IPv6 vulnerability where rt6_insert_exception() could successfully create a new exception for a dying fib6_info because the FIB6_EXCEPTION_BUCKET_FLUSHED bit was not being set correctly during certain removal sequences. This flaw creates a reference cycle between the ...

CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

EUVD-2026-103643

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98599

The Linux kernel contains a vulnerability in the bpf subsystem specifically within stack_slot_obj_get_spi(). The issue arises because bpf_get_spi() uses C division to compute an index, which truncates toward zero; consequently, an offset of 0 produces the same index as a valid stack slot at fp-8....

EUVD-2026-103637

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

EUVD-2026-103629

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

EUVD-2026-103626

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579

The Linux kernel contains a memory leak vulnerability in the nfc: llcp component. Specifically, the function nfc_genl_llc_sdreq() fails to free queued TLV nodes during three specific error paths: nested-attr parse failure , TLV alloc ENOMEM , and nfc_llcp_send_snl_sdreq() failure . The issue is r...

CVE-2026-98579 nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

EUVD-2026-103624

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98579

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure nfcgenlllcsdreq builds a list of TLV nodes while walking nested netlink attrs, but 3 error paths nested-attr parse failure, TLV alloc ENOMEM, nfcllcpsendsnlsdreq...

CVE-2026-98571

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: clear stale buf-page after recycling on skb build failure In stmmacrx, when napibuildskb fails the descriptor page is recycled back to the page pool with pagepoolrecycledirect, but buf-page is left pointing at the...

EUVD-2026-103607

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptptxskb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WXSTATEPTPTXINPROGRESS bit prevents multiple Tx paths from submitting timesta...

CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...