CVE-2026-98982

The Linux kernel contains a vulnerability where a pseudo dentry (e.g., for pipes or sockets) can be improperly used as the root of a mount. Specifically, d_alloc_pseudo() provides dentries with the DCACHE_NORCU flag, which are freed immediately by dentry_free() because they are not expected to be...

CVE-2026-98982 namespace: don't let a pseudo dentry become the root of a mount

In the Linux kernel, the following vulnerability has been resolved: namespace: don't let a pseudo dentry become the root of a mount dallocpseudo hands out dentries for pipes, sockets and other files that are never anyone's child or parent. They carry DCACHENORCU and dentryfree frees them right aw...

CVE-2026-98972

The Linux kernel contains a vulnerability in the cgroup/cpuset subsystem where the is_in_v2_mode() helper function could potentially access a stale cpuset_cgrp_subsys.root pointer during a cgroup filesystem rebind. This creates a potential Use-After-Free (UaF) situation. To remediate this, a new ...

CVE-2026-98972 cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

EUVD-2026-108766

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

CVE-2026-98972 cgroup/cpuset: Don't access cpuset_cgrp_subsys.root in is_in_v2_mode()

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Don't access cpusetcgrpsubsys.root in isinv2mode After seeing the patch 1 to guard isinv2mode with RCU, it makes me realize that isinv2mode may be called in a context where a new cgroup filesystem is being rebound...

CVE-2026-98968 amt: send the relay's General Query directly from the receive path

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968 amt: send the relay's General Query directly from the receive path

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98968

The Linux kernel contains a use-after-free vulnerability in the amt driver. A socket buffer (skb) queued in a qdisc can outlive the tunnel it references because the tunnel pointer is stored as a raw pointer in skb->cb. Specifically, if a tunnel expires and is freed while a packet (e.g., one wi...

EUVD-2026-108762

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98964

The Linux kernel contains a vulnerability in the nvmet component where nvmet_req_alloc_p2pmem_sgls() fails to properly handle metadata allocation errors. Specifically, if data allocation succeeds but metadata allocation fails, the out_free_sg function passes req->p2p_dev to pci_p2pmem_free_sgl...

CVE-2026-98964 nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

EUVD-2026-108919

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98945 HID: steam: Rearrange teardown sequence

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98945 HID: steam: Rearrange teardown sequence

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98945

The Linux kernel contains a vulnerability in the HID: steam driver related to a narrow window during the teardown sequence. The issue is caused by callbacks being scheduled during cleanup, which can result in a dangling pointer to a now-freed steam struct . To resolve this, the teardown sequence ...

CVE-2026-98945

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

DEBIAN-CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

AZL-110647 CVE-2026-98896 affecting package kernel for versions less than 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...

CVE-2026-98896

In the Linux kernel, the following vulnerability has been resolved: thunderbolt: Keep the domain reference while processing hotplug We process hotplug events in a workqueue that may run after the domain has been removed by tbdomainremove. For example if user unloads the driver while at the same...