EUVD-2026-86977

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98146 accel/amdxdna: Remove __counted_by from struct amdxdna_cmd_chain

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: Remove countedby from struct amdxdnacmdchain struct amdxdnacmdchain contains a flexible array annotated with countedbycommandcount. Since the structure is stored in shared AMDXDNABOSHARE memory, userspace can modif...

CVE-2026-98065 bpf: Reject key-less BTF for hash maps

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98065

The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...

CVE-2026-98062

The Linux kernel contains a vulnerability where the signal_generate and signal_deliver tracepoints incorrectly declare their info argument as a struct kernel_siginfo pointer . Because btf_ctx_access() treats this as a trusted pointer, a tp_btf program can dereference non-pointer values like SEND_...

CVE-2026-98062 bpf: Mark signal tracepoint siginfo arguments as scalar

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

EUVD-2026-86715

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

CVE-2026-98062 bpf: Mark signal tracepoint siginfo arguments as scalar

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark signal tracepoint siginfo arguments as scalar The signalgenerate and signaldeliver tracepoints declare their info argument as a struct kernelsiginfo pointer. btfctxaccess therefore treats it as a trusted pointer for tpb...

CVE-2026-98007

The Linux kernel contains a vulnerability in the bpf_loop() helper function where the nr_loops argument is incorrectly declared as ARG_ANYTHING. This allows privileged programs to pass pointer values instead of scalars. Because the verifier marks these registers as precise, passing a pointer trig...

CVE-2026-98007 bpf: Reject non-scalar bpf_loop iteration counts

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

CVE-2026-98007 bpf: Reject non-scalar bpf_loop iteration counts

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

CVE-2026-97978

The Linux kernel contains a vulnerability in the eth: ice driver where the ice_tx_dim_work event triggers a double dereference in TP_printk(). This occurs because the tracing subsystem attempted to access pointers (specifically the ring or dim instance) long after the event was recorded, resultin...

CVE-2026-97970

The Linux kernel contains a vulnerability within the watchdog: msc313e component where the clk_get_rate() function could return 0, potentially leading to a division by zero panic . This issue has been resolved in the kernel to prevent system instability. No specific exploit information or exploit...

CVE-2026-97970 watchdog: msc313e: Avoid division by zero

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

EUVD-2026-86824

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-97970 watchdog: msc313e: Avoid division by zero

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97941

A race condition exists in the Linux kernel memory management system within mm/slab. The __slab_try_return_freelist() function incorrectly assumed that no objects were freed to a slab if slab->freelist was NULL and cmpxchg succeeded. This oversight leads to a classic ABA problem where a slab c...

CVE-2026-97934 tracing: Fix memory corruption from a "STACKTRACE" histogram key

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...