CLSA-2026-1786352940 kernel: Fix of 148 CVEs

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level CVE-2026-63807 - KVM: x86: Check for invalid/obsolete root after making MMU pages available CVE-2026-64561 - ubi: Fix use-after-free when volume resizing failed CVE-2023-53271 - ice: Check VF VSI Pointer Value in...

PT-2026-116837

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC MAX TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

CVE-2026-98756: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98467: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

CVE-2026-98747: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

CVE-2026-98785: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

PT-2026-117060

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driver data before registering notification handlers Both probe paths register their notification handler before assigning driver data, which the handler dereferences. In the devicetree path, the notification I...

PT-2026-116914

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

CVE-2026-98508: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98523: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drmatomic.c:2031 at drmatomichelpersetconfig+0x18e/0x1b0 drm Call Trace:...

CVE-2026-98753: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98717: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-116972

In the Linux kernel, the following vulnerability has been resolved: tty: tty port: restore TTY IO ERROR on activation failure Make sure to restore the TTY IO ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel...

PT-2026-116936

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

PT-2026-116971

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty port tty vhangup race Drivers rely on tty port tty vhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If tty port tty vhangup races...

CVE-2026-98752: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

PT-2026-116723

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 6.15 Description When CONFIG PCI DYNAMIC OF NODES is enabled, the dynamic Open Firmware OF helpers of pci prop bus range and of pci prop intr map dereference the pdev-subordinate variable without prior validation...

PT-2026-116727

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2.0 Description A NULL pointer dereference occurs in the drm/virtio component. The function virtio gpu fence alloc can return NULL during memory pressure, but the caller virtio gpu init submit does not verify the return...

PT-2026-116741

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the drm/imagination component where map failures from the pvr mmu map sgl function are not correctly propagated to the pvr mmu map function. This causes pvr mmu map to...

PT-2026-116742

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the DRM client handling where a partially initialized fbdev client remains registered if a failure occurs during drm fb helper initial config. When userspace closes th...