CVE-2026-98986

The Linux kernel contains a vulnerability where fsnotify marks of a mount namespace are removed from an RCU softirq context instead of a process context. This occurs because mnt_ns_tree_remove() hands a reference to call_rcu(), causing fsnotify_mntns_delete() to trigger a BUG by calling a sleepin...

EUVD-2026-108780

In the Linux kernel, the following vulnerability has been resolved: namespace: remove the fsnotify marks of a mount namespace in process context mntnsrelease drops the last passive reference of a mount namespace and removes its fanotify marks via fsnotifymntnsdelete. That takes the mutex of every...

EUVD-2026-108761

In the Linux kernel, the following vulnerability has been resolved: cxgb4/chktls: disable softirqs around tidlist erases chcrktlscplactopenrpl inserts into tidlist from the receive path using xainsertbh. The array is shared by the adapter's connections and initialized with XAFLAGSLOCKBH. However,...

CVE-2026-98967

The Linux kernel contains a vulnerability in the cxgb4/ch_ktls component where the tid_list array is handled inconsistently. Specifically, while the receive path correctly uses xa_insert_bh(), the chcr_ktls_dev_del() and chcr_ktls_dev_add() error paths incorrectly use xa_erase(). Because xa_erase...

CVE-2026-98829

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98829: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: A use-after-free issue was addressed in VEPA multicast source pruning. In ixgbevfcleanrxirq, frames whose source MAC matches the own address of the VF are pruned by freeing the skb and proceeding to the next descriptor...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: dm thin: Fixed a UAF in runtimersoftirq When dmresume and dmdestroy are executed concurrently, it will lead to a UAF, as follows: Bug: KASAN: Use-after-free in runtimers+0x173/0x710 A 8-byte value is written to the address...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fixed deadlock issue when using the NCM gadget The cdns3 driver suffers from the same deadlock issue as fixed in cdnsp with the commit 58f2fcb3a845 „usb: cdnsp: Fixed deadlock issue during use of the NCM gadget”. Unde...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: ppp: Do not assume that bh is held in pppchannelbridgeinput. The networking receive path is usually handled by the BH handler. However, some protocols require acquiring the socket lock, and packets may be stored in the socket...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schtaprio: Replace the direct dequeue call with peek and qdiscdequeuepeeked. When taprio’s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gsoskb. Then, tapriodequeuefromt...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: “Revert ‘sched/fair: Make sure to try to detach at least one movable task’” This change is reflected in commit b0defa7ae03ecf91b8bfd10ede430cff12fcbd06. The patch b0defa7ae03ec changed the load balancing logic to ignore env.maxlo...

SUSE CVE-2026-98046

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

SUSE CVE-2026-98058

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

SUSE CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

AZL-104553 CVE-2026-98058 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

DEBIAN-CVE-2026-98058

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

CVE-2026-98058

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark syscall helpers as sleepable bpfsysbpf executes the bpf2 syscall body, which can take mutexes, allocate with GFPKERNEL, and wait for an RCU grace period. bpfsysclose reaches closefd and filpclose, which can sleep as wel...

AZL-104603 CVE-2026-98046 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

CVE-2026-98046

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...