CVE-2026-98361 RDMA/rxe: Restore HMM_PFN_WRITE check in ODP write paths

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98361

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323

The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...

EUVD-2026-93308

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98318

The Linux kernel contains a vulnerability in the smb client where absolute native symlink targets are not properly validated before NT fixups when symlinkroot is unset. Because the code incorrectly assumes an NT prefix is present, providing a target like "/ab" causes out-of-bounds writes to the s...

EUVD-2026-93303

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98312 ALSA: 6fire: fix OOB write from device-reported iso length

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312

The Linux kernel contains an out-of-bounds (OOB) write vulnerability in the ALSA 6fire driver within the usb6fire_pcm_in_urb_handler() function. The issue stems from a calculation of outgoing isochronous packet sizes where a device-reported actual_length of less than 4 causes an integer wrap-arou...

EUVD-2026-93297

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312 ALSA: 6fire: fix OOB write from device-reported iso length

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98312

In the Linux kernel, the following vulnerability has been resolved: ALSA: 6fire: fix OOB write from device-reported iso length usb6firepcminurbhandler sizes each outgoing isochronous packet as actuallength - 4 / innanalog buffer, a 4832-byte object from kcallocPCMMAXPACKETSIZE, PCMNPACKETSPERURB...

CVE-2026-98277

The Linux kernel contains a vulnerability in the fbnic driver where the fbnic_tx_map() function fails to ring the doorbell or issue a completion request for packets in a burst if the final packet in that burst is dropped (e.g., due to skb_put_padto(), skb_cow_head(), or a DMA mapping failure). Th...

EUVD-2026-93205

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-98277 eth: fbnic: ring the doorbell if a burst ends in a drop

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

CVE-2026-98265 ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...

CVE-2026-98265

The Linux kernel contains a vulnerability in the ALSA usb-audio driver where the data_ep_set_params() function allocates data URB memory based on u->packets. However, for implicit feedback sinks, snd_usb_queue_pending_output_urbs() may overwrite this limit with a larger count from the sync sou...

EUVD-2026-93193

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp implicit feedback packet count to URB capacity dataepsetparams allocates each data URB for exactly u-packets isochronous frames, so urb-isoframedesc has u-packets slots and ctx-packets is the driver's only...