CVE-2026-98860

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

CVE-2026-98843

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98683

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98860 HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

CVE-2026-98860

The Linux kernel contains a vulnerability in the HID BPF subsystem related to how hid_bpf_hw_request handles hardware errors. When a transport driver returns a negative error code (e.g., -EPIPE ), the return value is implicitly promoted to size_t, causing a comparison against size to evaluate as ...

CVE-2026-98860 HID: bpf: cast size to ssize_t when checking hid_bpf_hw_request

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

EUVD-2026-103800

In the Linux kernel, the following vulnerability has been resolved: HID: bpf: cast size to ssizet when checking hidbpfhwrequest As reported by Sashiko: If a transport driver encounters a hardware error and returns a negative error code such as -EPIPE, ret is implicitly promoted to sizet when...

CVE-2026-98844

The Linux kernel contains a vulnerability in the netfs component where the pagecache is not properly cleared when a file is extended via a write operation. Specifically, dirty data left by writes through an mmapped region in a hole created after the End-of-File (EOF) could persist. The fix involv...

CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98844 netfs: clear post-EOF pagecache when extending a file via write

In the Linux kernel, the following vulnerability has been resolved: netfs: clear post-EOF pagecache when extending a file via write Fix netfs to erase the contents of a hole created after the EOF by an ordinary write if dirty data has been previously left there by writes through an mmapped region...

CVE-2026-98843

The Linux kernel contains a vulnerability in the netfs component where the netfs_read_gaps() function left gaps around a streaming write's dirty region unread on the server side. This issue could cause stale folio content to be written back if a short or EOF response occurred. The fix involves ze...

EUVD-2026-103783

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98843

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98843 netfs: zero gaps in read-gaps folio to avoid writing back stale data

In the Linux kernel, the following vulnerability has been resolved: netfs: zero gaps in read-gaps folio to avoid writing back stale data netfsreadgaps leaves gaps around a streaming write's dirty region unread on the server side, so a short/EOF response there left stale folio content that later g...

CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

CVE-2026-98728

The Linux kernel contains an off-by-four bounds check vulnerability in the tpm2_get_random() function. When a response includes the TPM2_ST_SESSIONS tag, the function skips a 4-byte parameter size field but incorrectly validates the response length against TPM_HEADER_SIZE. This allows a truncated...

CVE-2026-98728 tpm: fix off-by-four bounds check in tpm2_get_random()

In the Linux kernel, the following vulnerability has been resolved: tpm: fix off-by-four bounds check in tpm2getrandom When the response carries the TPM2STSESSIONS tag, tpm2getrandom skips the 4-byte parameter size field before locating the random data, but the bounds check still validates the...

EUVD-2026-103937

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...

CVE-2026-98683

The Linux kernel contains a vulnerability in the SMB client component. The smb3_zero_range() function, which emulates FALLOC_FL_ZERO_RANGE, fails to unconditionally flush dirty data before invalidating the page cache and issuing FSCTL_SET_ZERO_DATA to the server. This occurs specifically for inte...

CVE-2026-98683 smb: client: flush dirty data before zeroing a range

In the Linux kernel, the following vulnerability has been resolved: smb: client: flush dirty data before zeroing a range smb3zerorange emulates FALLOCFLZERORANGE by invalidating the page cache over the target range with truncatepagecacherange and then issuing FSCTLSETZERODATA to the server. Dirty...