CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455

The Linux kernel contains a vulnerability in the Bluetooth RFCOMM stack where a NULL pointer dereference occurs in the RFCOMM_CONNINFO getsockopt handler. When BT_DEFER_SETUP is enabled, the dlc->defer_setup flag remains set even if the session is cleared during rfcomm_recv_disc(). Consequentl...

EUVD-2026-103695

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455 Bluetooth: RFCOMM: fix NULL dereference of dlc->session in RFCOMM_CONNINFO

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98455

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CLSA-2026-1783414634 kernel: Fix of 14 CVEs

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role CVE-2026-46113 - net: afkey: zero aligned sockaddr tail in PFKEY exports CVE-2026-43088 - ext4: block range must be validated before use in ext4mbclearbb CVE-2022-50021 - ext4: add strict range checks while freeing blocks...

CLSA-2026-1786352940 kernel: Fix of 148 CVEs

KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level CVE-2026-63807 - KVM: x86: Check for invalid/obsolete root after making MMU pages available CVE-2026-64561 - ubi: Fix use-after-free when volume resizing failed CVE-2023-53271 - ice: Check VF VSI Pointer Value in...

PT-2026-117068

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcp newlink creates the UDP socket before register netdevice. If registration fails after pfcp dev init succeeds, the core calls pfcp dev uninit, which releases the...

CVE-2026-98688: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Fix NULL dereference in tbremovework There is a slight race between tbremovework and tbdomainremove which leads to dereferencing a NULL tb-rootswitch pointer inside tbfreeunpluggedxdomains: Thread A Thread B...

CVE-2026-98651: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Properly handle NULL pointer in datcondsetstoragekey Some callers pass NULL as oldkey. Calling pagecondsetstoragekey will cause that NULL pointer to get dereferenced. Fix by checking for NULL and assigning the pointer ...

CVE-2026-98522: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvrmmumapsgl Map failure from pvrmmumapsgl interface was not returned correctly to pvrmmumap interface. This resulted in pvrmmumap interface to continue instead of returning ...

PT-2026-116729

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Linux kernel's DRM XE driver. In the xe vm close and put function, page tables PTs were destroyed via xe vm pt destroy before contested Virtual Memory Area...

PT-2026-116971

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix tty port tty vhangup race Drivers rely on tty port tty vhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If tty port tty vhangup races...

CVE-2026-98717: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Bail from shadow walks if the root is invalid or a dummy When walking shadow page tables, immediately terminate the walk if the root is a "dummy" root, i.e. a root whose top-level page table is backed by the zero...

CVE-2026-98676: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iio: adc: ade9000: fix NULL pointer dereference in clkout registration ade9000setupclkout passes NULL as the register address when registering a divider clock. During clock registration, the common clock framework calls...

CVE-2026-98756: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98753: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98455: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMMCONNINFO The RFCOMMCONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-skstate != BTCONNECTED &&...

CVE-2026-98616: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: reset numnapi when the napi vectors are freed fbn-numnapi is the count of live napi vectors, each of which owns an IRQ. The PM path had freed them without clearing the count. fbnicpmsuspend tears the datapath down via...

CVE-2026-98618: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...