EUVD-2026-108830

In the Linux kernel, the following vulnerability has been resolved: mmc: mtk-sd: Cancel request timeout work on remove The driver queues reqtimeout while a request is active. msdcrequestdone uses canceldelayedwork, which does not wait for a timeout callback that has already started. The timeout...

CVE-2026-99032 net/smc: protect clcsock lifetime in smc_getname

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

CVE-2026-99032 net/smc: protect clcsock lifetime in smc_getname

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

CVE-2026-99032

The Linux kernel is vulnerable to a use-after-free or NULL dereference in the smc_getname() function within the net/smc component. The issue occurs because smc_getname() dereferences smc->clcsock without acquiring the clcsock_release_lock. If a link-group termination triggers smc_close_active_...

EUVD-2026-108827

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

CVE-2026-99032

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

CVE-2026-99027

The Linux kernel contains a slab-use-after-free vulnerability within the net: team component. The issue occurs because a nonzero dev_queue_xmit() result does not return ownership of the skb . Consequently, when an override port's qdisc drops the packet, the queue override helper incorrectly attem...

EUVD-2026-108822

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

CVE-2026-99027 net: team: stop reusing skb after queue override

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

CVE-2026-99027 net: team: stop reusing skb after queue override

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

CVE-2026-99015 Bluetooth: hci_sock: Serialize dead-device detachment

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...

CVE-2026-99015 Bluetooth: hci_sock: Serialize dead-device detachment

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...

EUVD-2026-108809

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...

CVE-2026-99015

The Linux kernel contains a race condition in the Bluetooth hci_sock component where rebinding an HCI socket after a controller is unregistered can crash the kernel. The root cause is a lack of proper serialization: hci_sock_bind() clears the device reference under only the socket lock, while sen...

CVE-2026-99014 Bluetooth: hci_sync: Fix command skb lifetime during scan setup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup from hcisentcmddata. The returned pointer borrows storage from sentcmd...

CVE-2026-99014 Bluetooth: hci_sync: Fix command skb lifetime during scan setup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup from hcisentcmddata. The returned pointer borrows storage from sentcmd...

EUVD-2026-108808

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: Fix command skb lifetime during scan setup During PA sync scan setup, hcilesetextscanparamsync gets the address used for the PALINK lookup from hcisentcmddata. The returned pointer borrows storage from sentcmd...

CVE-2026-99014

The Linux kernel 's Bluetooth stack is vulnerable to a slab-use-after-free in the hci_sync component during PA sync scan setup . Specifically, hci_le_set_ext_scan_param_sync() retrieves a pointer from hci_sent_cmd_data() without holding a reference to the underlying skb. Because the scan worker a...

CVE-2026-99013 Bluetooth: ISO: Reject concurrent BIS listener setup

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...

EUVD-2026-108807

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Reject concurrent BIS listener setup isosocklisten drops the socket lock before calling isolistenbis to preserve the hdev-lock ordering. Two concurrent listen calls on the same broadcast socket can therefore both...