CVE-2026-98618: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

CVE-2026-98752: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98785: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

PT-2026-116741

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Propagate map failures correctly from pvr mmu map sgl Map failure from pvr mmu map sgl interface was not returned correctly to pvr mmu map interface. This resulted in pvr mmu map interface to continue instead of...

PT-2026-117015

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtk eth soc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummy dev. mtk probe creates that dummy device, and adds the shared tx/rx NAPI to it, only...

PT-2026-116695

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccw device get util str The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpid to chp can retu...

PT-2026-117017

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in set coalesce before first open The Rx ring priv and index are only set in bcmgenet init rx ring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opene...

CVE-2026-98821: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

PT-2026-116966

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serial core unregister port port-port dev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serial core port device add...

PT-2026-116983

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: f fs: Fix NULL pointer dereference in FUNCTIONFS ENDPOINT DESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFS HAS FS DESC and the gadget operates at a higher speed such a...

PT-2026-116674

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: fix NULL dereference of dlc-session in RFCOMM CONNINFO The RFCOMM CONNINFO getsockopt handler accepts a socket that is not connected as long as deferred setup is enabled: if sk-sk state != BT CONNECTED && !rfco...

CVE-2026-98747: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

PT-2026-116975

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3 pci probe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pci set drvdata, while the second...

CVE-2026-98849: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: pfcp: fix socket lifetime on netdevice registration failure pfcpnewlink creates the UDP socket before registernetdevice. If registration fails after pfcpdevinit succeeds, the core calls pfcpdevuninit, which releases the socket an...

CVE-2026-98841: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: virt: vmgenid: set driverdata before registering notification handlers Both probe paths register their notification handler before assigning driverdata, which the handler dereferences. In the devicetree path, the notification IRQ...

PT-2026-117031

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctp dev only after it is initialised mctp add dev links the new mctp dev into dev-mctp ptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a net device pointer...

PT-2026-116784

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for ID MT7530: both the devm regulator get in probe and the regulator enable in mt7530 setup are guarded by the...

PT-2026-116742

In the Linux kernel, the following vulnerability has been resolved: drm/client: fix restore of partially initialized client I got a null-ptr-deref report when closing a DRM file descriptor: WARNING: drivers/gpu/drm/drm atomic.c:2031 at drm atomic helper set config+0x18e/0x1b0 drm Call Trace: drm...

PT-2026-116914

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix ioctl hangup race The tty ioctls can race with hangup and end up calling into a tty driver for a device that is already gone or powered down. Serialise the callbacks using the tty port mutex and add the missing...

PT-2026-116837

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNIC MAX TXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...