CVE-2026-98348 wifi: libipw: reject too-short association responses

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

EUVD-2026-93333

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98348 wifi: libipw: reject too-short association responses

In the Linux kernel, the following vulnerability has been resolved: wifi: libipw: reject too-short association responses libipwhandleassocresp reads the capability, status and aid fields of the 30-byte association response prefix and then computes the information element length as stats-len -...

CVE-2026-98345

The Linux kernel contains a vulnerability within the cfg80211 component, specifically in the cfg80211_classify8021d() function. The issue occurs when a frame mimicking an IP packet is transmitted but is too short, causing the DS field to be read incorrectly. This leads to an uninit-value error as...

CVE-2026-98345 wifi: cfg80211: check IP header size in cfg80211_classify8021d()

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

EUVD-2026-93283

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98298 dmaengine: mmp_pdma: fix wrong sg length in mmp_pdma_prep_slave_sg()

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98298

The Linux kernel contains a vulnerability in the dmaengine component, specifically within the mmp_pdma driver. The root cause is an error in the mmp_pdma_prep_slave_sg() function where for_each_sg() incorrectly retrieves the entry length from the list head (sgl) instead of the current entry (sg)....

CVE-2026-98292 Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

CVE-2026-98292

The Linux kernel contains a vulnerability in the btmtksdio and btmtkuart Bluetooth drivers. The issue arises because these drivers cast received WMT events directly to struct btmtk_hci_wmt_evt and read fields without verifying the event length. Additionally, in the FUNC_CTRL case, the drivers cas...

CVE-2026-98292 Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

EUVD-2026-93220

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio, btmtkuart: validate WMT event length before struct access btmtksdio.c and btmtkuart.c cast a received WMT event straight to struct btmtkhciwmtevt and read its op/flag fields without checking the event is lon...

CVE-2026-98287 pppoatm: ensure a writable skb header and linear data

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98287

The Linux kernel contains a vulnerability in the pppoatm component where the pppoatm_send() function fails to ensure the skb header is writable when performing LLC encapsulation. While standard packets use skb_cow_head(), packets arriving via PPP channel bridging (PPPIOCBRIDGECHAN) bypass this ch...

CVE-2026-98287 pppoatm: ensure a writable skb header and linear data

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

EUVD-2026-93215

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98279 btrfs: handle lack of space when cleaning up verity items

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

CVE-2026-98279 btrfs: handle lack of space when cleaning up verity items

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

EUVD-2026-93207

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

CVE-2026-98247 Bluetooth: hci_codec: validate vendor codec count length

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicodec: validate vendor codec count length The Read Local Supported Codecs parsers consume the variable-sized standard codec array before parsing the vendor codec count. Although the initial reply-size check includes...