CVE-2026-98854

The Linux kernel contains a vulnerability in the of/overlay component where of_overlay_fdt_apply() incorrectly stores the return value of idr_alloc() in ovcs->id before verifying its success. If the allocation fails, ovcs->id becomes negative, causing free_overlay_changeset() to bypass its ...

CVE-2026-98854 of/overlay: only treat a positive changeset id as registered

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

CVE-2026-98849 pfcp: fix socket lifetime on netdevice registration failure

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

EUVD-2026-103789

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

CVE-2026-98849 pfcp: fix socket lifetime on netdevice registration failure

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

CVE-2026-98849

The Linux kernel contains a vulnerability in the pfcp component where a NULL pointer dereference occurs during netdevice registration failure . Specifically, in pfcp_newlink(), if registration fails after pfcp_dev_init() succeeds, the core calls pfcp_dev_uninit(), which releases the socket and cl...

CVE-2026-98848

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Assign .num before accessing .hws Commit f316cdff8d67 "clk: Annotate struct clkhwonecelldata with countedby" annotated the hws member of 'struct clkhwonecelldata' with countedby, which informs the bounds sanitizer...

CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841 virt: vmgenid: set driver_data before registering notification handlers

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

EUVD-2026-103781

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

CVE-2026-98841

The Linux kernel contains a vulnerability in the virt: vmgenid component where notification handlers are registered before driver_data is assigned. This improper ordering causes a kernel NULL pointer dereference and a system panic if an interrupt or ACPI notification occurs during the probe path....

CVE-2026-98821 block: reject polled dio with user integrity metadata

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98821 block: reject polled dio with user integrity metadata

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98812

A vulnerability exists in the Linux kernel 's net/mctp component where the mctp_add_dev() function incorrectly links a new mctp_dev into dev->mctp_ptr before the mdev->dev pointer is assigned. This race condition allows a reader to pick up the device in a window where it still points to NUL...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

EUVD-2026-103897

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98795

The Linux kernel contains a vulnerability in the sparx5 driver where unbinding the driver can lead to a NULL pointer dereference . This occurs because sparx5_ptp_init() returns early on certain lan969x variants (due to a missing SPX5_FEATURE_PTP flag) or when no "ptp" interrupt is described, but ...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...