CVE-2026-98759

The Linux kernel contains a vulnerability in the usb: typec: tipd component where cd321x_update_work() fails to fully initialize a stack-allocated typec_partner_desc before passing it to typec_register_partner(). This oversight allows garbage function pointers to be stored in the attach and deatt...

CVE-2026-98759 usb: typec: tipd: fix uninitialized typec_partner_desc in cd321x_update_work()

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98755

A vulnerability exists in the Linux kernel within the tty: vcc component. The vcc_send_ctl() function fails to fully zero-initialize the stack-allocated struct vio_vcc pkt structure. Specifically, the tag.stype_env field remains uninitialized before being transmitted via ldc_write(), which can re...

CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl()

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

CVE-2026-98755 tty: vcc: zero-initialize control packet in vcc_send_ctl()

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

EUVD-2026-103840

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98613

The Linux kernel contains a vulnerability where program-allocated objects can own other local objects via referenced kptrs . The bpf_obj_free_fields() function follows these pointers synchronously through __bpf_obj_drop_impl() before RCU-based freeing. This allows self-referential local kptr type...

EUVD-2026-103658

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98613 bpf: Bound ownership depth through local kptrs and graph roots

In the Linux kernel, the following vulnerability has been resolved: bpf: Bound ownership depth through local kptrs and graph roots Program-allocated objects can own other local objects through referenced kptrs. bpfobjfreefields follows those pointers through bpfobjdropimpl synchronously, before t...

CVE-2026-98584

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

CVE-2026-98584 net/sched: fix potential stack infoleak in em_text_dump()

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

EUVD-2026-103629

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix potential stack infoleak in emtextdump emtextdump allocates struct tcfemtext on the stack without zeroing it. strscpy writes the algorithm name and a NUL terminator into conf.algo, leaving the remaining bytes...

EUVD-2026-103573

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98528

The Linux kernel contains a vulnerability in the gpio cdev component where a failure to acquire the GPIO chip guard in gpio_desc_to_lineinfo() causes the function to return prematurely. This results in a kernel stack leak to user-space because the information structure is not zeroed before being ...

CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98528 gpio: cdev: fix kernel stack leak to user-space in error path

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98528

In the Linux kernel, the following vulnerability has been resolved: gpio: cdev: fix kernel stack leak to user-space in error path If we fail to acquire the GPIO chip guard in gpiodesctolineinfo, we return immediately before zeroing the info struct we'll end up passing to the user-space later in...

CVE-2026-98466

A flaw exists in the Linux kernel's KVM subsystem on ARM64 platforms. During protected virtualization mode initialization, the hypervisor fails to revoke host stage-2 access permissions for per-CPU hypervisor stack memory pages because the fix_host_ownership() function fails to walk the private V...

CVE-2026-98466 KVM: arm64: Transfer the hyp stack pages out of the host stage-2

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...