CVE-2026-98121 watchdog: msc313e: Fix NULL pointer dereference in PM callbacks

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

CVE-2026-98121

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

EUVD-2026-86952

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

CVE-2026-98119 netfs: break unbuffered write when netfs_alloc_subrequest() fails

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

EUVD-2026-86950

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

CVE-2026-98119 netfs: break unbuffered write when netfs_alloc_subrequest() fails

In the Linux kernel, the following vulnerability has been resolved: netfs: break unbuffered write when netfsallocsubrequest fails syzbot reported a null-ptr-deref below 1 following a fault injection in netfsallocsubrequest. 0 When netfsallocsubrequest fails, subreq is NULL. Later, netfspreparewri...

CVE-2026-98119

A null-pointer dereference vulnerability exists in the Linux kernel 's netfs component. When netfs_alloc_subrequest() fails during an unbuffered write, it returns a NULL subrequest. The system subsequently attempts to initialize members of this NULL pointer within netfs_prepare_write() , leading ...

EUVD-2026-86928

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98098 tipc: fix NULL deref in tipc_named_node_up() on empty publication list

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98098 tipc: fix NULL deref in tipc_named_node_up() on empty publication list

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98098

A NULL pointer dereference exists in the Linux kernel 's TIPC (Transparent Inter-Process Communication) protocol. The vulnerability occurs in tipc_named_node_up() when the number of local publications exceeds TIPC_MAX_PUBL (65535). Under these conditions, protocol service types are not inserted i...

CVE-2026-98098

In the Linux kernel, the following vulnerability has been resolved: tipc: fix NULL deref in tipcnamednodeup on empty publication list User-space applications can bind a large number of service addresses to one or more sockets. Each binding of a local-scope service address inserts one entry...

CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

EUVD-2026-86916

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

CVE-2026-98086

The Linux kernel contains a vulnerability in the ALSA subsystem related to the UMP component. The function snd_ump_parse_endpoint() incorrectly sets ump->parsed on every exit, including errors, before the legacy rawmidi device is attached. Consequently, ump_handle_ep_name_msg() may treat parse...

CVE-2026-98086 ALSA: ump: do not touch legacy_rmidi before it exists

In the Linux kernel, the following vulnerability has been resolved: ALSA: ump: do not touch legacyrmidi before it exists sndumpparseendpoint sets ump-parsed on every exit, including error, before the caller attaches the legacy rawmidi device. umphandleepnamemsg then treats parsed as "legacyrmidi ...

EUVD-2026-86718

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98065 bpf: Reject key-less BTF for hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98065

The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...

CVE-2026-98065 bpf: Reject key-less BTF for hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...