CVE-2026-98962

The Linux kernel contains a vulnerability within the btrfs file system. Specifically, after the btrfs_uring_read_extent() function is called, the code incorrectly jumped to out_acct, causing it to skip the kfree(data->iov) operation. This memory deallocation is only appropriate for the -EIOCBQ...

EUVD-2026-108756

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98962 btrfs: free iov when btrfs_uring_read_extent() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98961 btrfs: unlock inode and extent in caller when io_uring read extent fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

EUVD-2026-108754

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98960 btrfs: don't stash io_uring encoded data across -EAGAIN

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98960

The Linux kernel 's btrfs filesystem contains a vulnerability where btrfs_uring_encoded_data is leaked if the request is cancelled or the ring exits before reissue. This occurs because the kernel returns -EAGAIN while leaving the encoded data in the command PDU, and io_uring does not free driver ...

CVE-2026-98947

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

EUVD-2026-108921

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947 vsock: Fix memory leak in vmci_transport_recv_dgram_cb()

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98947

The Linux kernel contains a memory leak vulnerability within the vmci_transport_recv_dgram_cb() function. During the closure of a datagram socket , this function may add packets to the socket's backlog. Subsequently, the __release_sock() function moves these packets from the backlog back to the r...

CVE-2026-98944

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and th...

EUVD-2026-108918

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and th...

DEBIAN-CVE-2026-98909

In the Linux kernel, the following vulnerability has been resolved: net: cpswnew: unregister devlink on port registration failure cpswprobe registers devlink before registering the CPSW ports. If cpswregisterports fails, the error path only unregisters the notifiers and then releases the lower...

DEBIAN-CVE-2026-98911

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...

CVE-2026-98909

In the Linux kernel, the following vulnerability has been resolved: net: cpswnew: unregister devlink on port registration failure cpswprobe registers devlink before registering the CPSW ports. If cpswregisterports fails, the error path only unregisters the notifiers and then releases the lower...

CVE-2026-98911

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: fix the error path in dpaa2switchrx In case of an error in dpaa2switchrx, the dpaa2switchfreefd function is called in order to free the FD. This is incorrect since the dpaa2switchfreefd is intended to be used on Tx...

DEBIAN-CVE-2026-98908

In the Linux kernel, the following vulnerability has been resolved: net: microchip: sparx5: clean up PSFP resources on flower setup failure sparx5tcflowerpsfpsetup allocates PSFP stream gate, flow meter and stream filter resources before adding VCAP actions. If a later step fails, the resources...