CVE-2026-97593

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...

CVE-2026-97936

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parsefield sets HISTFIELDFLSTACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved t...

CVE-2026-97532

In the Linux kernel, the following vulnerability has been resolved: scsi: qla2xxx: Null out freed pointers in qla2x00memalloc error path When qla2x00memalloc fails, qla2x00probeone jumps to probehwfailed and calls qla2x00memfree. Several error labels in qla2x00memalloc freed adapter members...

CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-98030

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98151

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix REG INVARIANTS VIOLATION on speculative pointer arithmetic Take the following unprivileged program as an example: r0 = bpfmaplookupelem... / PTRTOMAPVALUE, offset 0 / ... 14: r0 += r1 / r1 is a bounded scalar / 15: r9 = ...

CVE-2026-98134

In the Linux kernel, the following vulnerability has been resolved: bpf: checkcondjmpop: properly infer if register is null Nicholas Carlini reported a bug when verifier can incorrectly infer that a pointer is non-null. The bug occurs when two pointers are compared and one of them has a type w/o...

CVE-2026-98043

In the Linux kernel, the following vulnerability has been resolved: bpf: Don't infer non-NULL from a pointer with an unbounded offset regnotnull decides that a register holds a non-NULL value by looking at its type alone. For pointer types that allow arithmetic the type only guarantees a non-NULL...

CVE-2026-97980

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

CVE-2026-98038

In the Linux kernel, the following vulnerability has been resolved: bpf: Keep refcountacquire nullable for borrowed RCU kptrs bpfrefcountacquire is fallible for a borrowed reference because the object may have reached a zero refcount. The verifier therefore keeps KFRETNULL on the return value...

CVE-2026-98065

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject key-less BTF for hash maps mapcheckbtf allows a key-less BTF btfkeytypeid == 0 only for maps that have a -mapcheckbtf callback, and leaves the actual decision to that callback. Hash maps used to have no -mapcheckbtf, ...

CVE-2026-98145

In the Linux kernel, the following vulnerability has been resolved: accel/amdxdna: reject a command chain that carries no commands A chain whose commandcount is zero passes the payload length check, because structsizepayload, data, 0 is just the header. The fill loop then does not run, so offset...

CVE-2026-98059

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and kernelwaitidprepare does likewise for waitidPALL. btfctxaccess currently...

CVE-2026-97975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-98121

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix NULL pointer dereference in PM callbacks msc313ewdtprobe doesn't set the driver data for the platform device. As a result, devgetdrvdata in msc313ewdtsuspend and msc313ewdtresume will return NULL, leading t...

Linux Distros Unpatched Vulnerability : CVE-2026-97980

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 s390/debug: Ad...

Linux Distros Unpatched Vulnerability : CVE-2026-98059

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Mark schedprocesswait argument as nullable dowait passes wo-wopid to the schedprocesswait tracepoint. kernelwait4 leaves wopid NULL for wait4-1, and...

CVE-2026-97601: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: fix NULL dereference in lowpannewlink TUNSETLINK allows a TUN device to change its link-layer type to ARPHRDIEEE802154 without initializing ieee802154ptr. lowpannewlink checks only the device type before...

CVE-2026-97593: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/s390: Fix NULL dereference in iovatophys with ZPCITABLETYPERFX When using a 5-level translation table via ZPCITABLETYPERFX getrsofromiova returns NULL when the region-first entry is invalid. Yet in getrtofromiova the...