CVE-2026-98123 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

CVE-2026-98123 sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

EUVD-2026-86954

In the Linux kernel, the following vulnerability has been resolved: sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration sctpverifyasconf walks ASCONF-ACK parameters with sctpwalkparams, which advances by SCTPPAD4length, while the consumer sctpgetasconfresponse iterates the same...

CVE-2026-98123

The Linux kernel is vulnerable to a remote denial of service (DoS) and an out-of-bounds read due to how SCTP handles ASCONF-ACK parameters. The sctp_verify_asconf() function uses padding during parameter iteration, while the consumer sctp_get_asconf_response() iterates using raw lengths. An odd-l...

CVE-2026-98111 Bluetooth: btintel: validate version TLV value lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

CVE-2026-98111

The Linux kernel contains a vulnerability in the btintel Bluetooth driver within the btintel_parse_version_tlv() function. The flaw occurs because the function verifies the presence of a TLV (Type-Length-Value) but fails to ensure the value length is sufficient for the specific TLV type. This ove...

CVE-2026-98111 Bluetooth: btintel: validate version TLV value lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

EUVD-2026-86942

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate version TLV value lengths btintelparseversiontlv verifies that a complete TLV is present in the response, but it does not ensure that the value is long enough for the specific TLV type. A short value...

CVE-2026-98110

The Linux kernel contains a vulnerability in the Bluetooth btintel driver where the firmware ID is incorrectly treated as a NUL-terminated string. Because the TLV length is the only actual boundary, the snprintf() function may read beyond the received response if a NUL terminator is missing. The ...

CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

EUVD-2026-86941

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98110 Bluetooth: btintel: bound firmware ID by TLV length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: bound firmware ID by TLV length The firmware ID is treated as a NUL-terminated string even though the TLV length is its only boundary. If the value does not contain a NUL terminator, snprintf can read beyond t...

CVE-2026-98088

The Linux kernel contains an out-of-bounds array read vulnerability within the scsi: mpt3sas driver. The issue occurs in the _base_assign_reply_queues() function because dev_to_node() can return NUMA_NO_NODE (-1) on systems lacking NUMA topology information (e.g., certain single-socket boards). T...

CVE-2026-98088 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

EUVD-2026-86918

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

CVE-2026-98088 scsi: mpt3sas: Avoid out-of-bounds cpumask_of_node() call in _base_assign_reply_queues()

In the Linux kernel, the following vulnerability has been resolved: scsi: mpt3sas: Avoid out-of-bounds cpumaskofnode call in baseassignreplyqueues devtonode can return NUMANONODE -1 on systems without NUMA topology information for the PCI device, such as single-socket boards that don't expose...

CVE-2026-98077 netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

CVE-2026-98077

The Linux kernel contains an out-of-bounds (OOB) read vulnerability in the netfilter: nf_conntrack_sip component. The root cause is located in the sip_skip_whitespace() function, which fails to return NULL when its loop exhausts the buffer (where dptr == limit). Because the calling function ct_si...

EUVD-2026-86907

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

CVE-2026-98077 netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...