EUVD-2026-93357

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98372 xfrm: iptfs: fix stack OOB read in iptfs_skb_reset_frag_walk()

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98372

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix stack OOB read in iptfsskbresetfragwalk iptfsskbresetfragwalk advances to the fragment containing @offset with an unbounded loop: while offset = walk-past + walk-fragswalk-fragi.len walk-past +=...

CVE-2026-98372

The Linux kernel contains a stack out-of-bounds (OOB) read vulnerability in the xfrm: iptfs component. The issue stems from the iptfs_skb_reset_frag_walk() function, which uses an unbounded loop to advance fragments without checking if the index exceeds the nr_frags limit. While one caller is pro...

CVE-2026-98363

The Linux kernel contains a vulnerability in the arm_scpi firmware component. The function scpi_dvfs_get_info() failed to validate upper bounds on the opp_count received from the SCP firmware, only rejecting zero counts. Because the shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps...

CVE-2026-98363 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

EUVD-2026-93348

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

CVE-2026-98363 firmware: arm_scpi: reject DVFS OPP count above MAX_DVFS_OPPS

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

CVE-2026-98362 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

CVE-2026-98362

The Linux kernel contains a vulnerability in the SCPI clock driver where dvfs_get_idx() fails to perform an upper bound check on the DVFS index. If the SCP firmware is buggy or provides stale values, it can return a large index that exceeds the info->opps range. This results in a KASAN Out-of-...

CVE-2026-98362 clk: scpi: bound-check DVFS index in scpi_dvfs_recalc_rate

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

CVE-2026-98349 wifi: libipw: reject too-short beacon and probe responses

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short beacon and probe responses libipwprocessproberesponse and the libipwnetworkinit call it makes assume the frame contains the full 36-byte beacon and probe response prefix, but the ipw2100 and ipw2200...

CVE-2026-98348 wifi: libipw: reject too-short association responses

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

EUVD-2026-93333

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98348

The Linux kernel contains a vulnerability in the wifi: libipw component where the libipw_handle_assoc_resp() function incorrectly computes the information element length. Because stats->len is a u16 and sizeof() returns a size_t , the subtraction stats->len - sizeof(*frame) wraps as a size_...

CVE-2026-98348 wifi: libipw: reject too-short association responses

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98345

The Linux kernel contains a vulnerability within the cfg80211 component, specifically in the cfg80211_classify8021d() function. The issue occurs when a frame mimicking an IP packet is transmitted but is too short, causing the DS field to be read incorrectly. This leads to an uninit-value error as...

CVE-2026-98345 wifi: cfg80211: check IP header size in cfg80211_classify8021d()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

EUVD-2026-93283

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...