UBUNTU-CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

UBUNTU-CVE-2026-98586

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

UBUNTU-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98586

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98561

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfpnetipsecrx drops the XArray lock before taking a reference to the xfrmstate it found. The delete path can erase the entry and drop the last state reference in that interval. RX ca...

SUSE CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

DEBIAN-CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

DEBIAN-CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

DEBIAN-CVE-2026-98586

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

AZL-108647 CVE-2026-98586 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

CVE-2026-98586

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...

AZL-108833 CVE-2026-98581 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98581

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix list corruption / refcount desync in nfcllcprecvdm nfcllcprecvdm handles DMNOBOUND/DMREJ for a socket that is still linked on local-connectingsockets: it looks the socket up with nfcllcpconnectingsockget, sets...

CVE-2026-98552

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98712

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

CVE-2026-98712 KVM: arm64: vgic: Take a refcount on IRQs referenced by last_lr_irq

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: vgic: Take a refcount on IRQs referenced by lastlrirq Referencing the last interrupt inserted in an LR is rather fragile, as this interrupt can vanish if a concurrently unmapped LPI. Solve this by bumping up the...

CVE-2026-98586

A vulnerability exists in the Linux kernel SCTP implementation where the code calls mod_timer() before acquiring the necessary reference for a rearmed timer without holding the sock lock . This creates a race condition during timer cleanup: if a timer is deleted after mod_timer() returns but befo...

EUVD-2026-103631

In the Linux kernel, the following vulnerability has been resolved: sctp: hold asoc or transport before modtimer in timer handlers Take the association or transport reference before rearming a timer in the timer handlers. The existing code calls modtimer before taking the reference needed by the...