CVE-2026-84854 Out of Bound Write on WibuKey for Windows

In the WibuKey driver for Windows below Version 6.72, insufficient validation of user input when calculating the size of a kernel buffer could cause small amounts of data to be written outside the intended kernel buffer. This can lead to a system crash. Under unfavorable circumstances, adjacent...

CVE-2026-80327 Open Redirect in PingGateway Fragment Filter

An open redirect vulnerability exists in the PingGateway Fragment Filter feature. This issue affects PingGateway versions 7.1.0 and later, 2023.2.0 through 2024.11.1, and 2025.3.0 through 2025.11.1. It is fixed in versions 2024.11.2, 2025.11.2, and 2026.3.0 and later...

CVE-2026-98372

The Linux kernel contains a stack out-of-bounds (OOB) read vulnerability in the xfrm: iptfs component. The issue stems from the iptfs_skb_reset_frag_walk() function, which uses an unbounded loop to advance fragments without checking if the index exceeds the nr_frags limit. While one caller is pro...

CVE-2026-98371

The Linux kernel contains a vulnerability in the xfrm: iptfs component where an attacker can trigger an unprivileged kernel panic (DoS) . The issue occurs during runt reassembly when an inner packet is split across outer packets; if the first fragment contains fewer than 4 bytes, __input_process_...

CVE-2026-98369

The Linux kernel contains a vulnerability in the xfrm component related to how transport-mode packets are reinjected. When xfrm_trans_reinject was converted to a workqueue, it began running in process context without an RCU read lock , triggering RCU lockdep warnings during finish callbacks (like...

CVE-2026-98370

The Linux kernel contains a use-after-free vulnerability in the xfrm component during ALLOCSPI requests. The issue arises because xfrm_state_netlink() and xfrm_alloc_userspi() perform redundant alloc_compat() calls. For compatibility requests, this causes the translator to misinterpret the 228-by...

CVE-2026-98368

The Linux kernel contains a vulnerability in the ESP (Encapsulating Security Payload) protocol when handling the out-of-place output path (esp->inplace == false ). The issue arises because ESP mutates the skb frag array without properly downgrading zerocopy managed frags (SKBFL_MANAGED_FRAG_RE...

CVE-2026-98367

A vulnerability exists in the Linux kernel RDMA/siw component where a Use-After-Free (UAF) condition can occur. If siw_qp_modify() fails within siw_accept(), the state_lock is released before error path cleanup. This creates a race window where a concurrent ibv_modify_qp() call can transition the...

CVE-2026-98366

The Linux kernel RDMA/rxe driver contains a slab-use-after-free vulnerability in the rxe_rereg_user_mr() function. The root cause is that the driver reassigns the memory region's protection domain (mr->ibmr.pd ) before validating the IB_MR_REREG_ACCESS argument. If validation fails, the reassi...

CVE-2026-98364

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem during bundle creation. The functions xfrm_bundle_create() and xfrm_create_dummy_bundle() improperly read dst->dev into a local pointer without acquiring a device reference before passing it to xfrm_fill_dst()....

CVE-2026-98365

A vulnerability exists in the Linux kernel RDMA/rxe driver where integer overflow in the mr_check_range() function allows for out-of-bounds (OOB) access . Because the function uses wraparound-prone arithmetic to validate the range of registered Memory Regions (MR), a remote peer can craft an RDMA...

CVE-2026-98363

The Linux kernel contains a vulnerability in the arm_scpi firmware component. The function scpi_dvfs_get_info() failed to validate upper bounds on the opp_count received from the SCP firmware, only rejecting zero counts. Because the shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps...

CVE-2026-98362

The Linux kernel contains a vulnerability in the SCPI clock driver where dvfs_get_idx() fails to perform an upper bound check on the DVFS index. If the SCP firmware is buggy or provides stale values, it can return a large index that exceeds the info->opps range. This results in a KASAN Out-of-...

CVE-2026-98361

The Linux kernel contains a vulnerability in the RDMA/rxe driver where the rxe_check_pagefault() function failed to perform access permission tests, retaining only the HMM_PFN_VALID check. This allowed ODP write operations, such as RDMA WRITE and SEND payloads, to modify read-only pages (e.g., pa...

CVE-2026-98360

The Linux kernel contains a vulnerability in the RDMA/rxe driver where a newly allocated multicast group (mcg) is published to the mcg_tree before the backing Ethernet multicast address is successfully programmed via rxe_mcast_add(). If rxe_mcast_add() fails (e.g., due to -ENODEV), the system fre...

CVE-2026-98358

The Linux kernel contains a vulnerability in the IB/iser stack where the system fails to properly reject remote invalidations of unregistered directions. Specifically, iser_reg_mem_fastreg() leaves rdma_reg[ISER_DIR_OUT].desc as NULL for write commands with immediate data, while iser_dma_map_task...

CVE-2026-98359

The Linux kernel contains a vulnerability in the RDMA/core component. The function ib_get_eth_speed() fails to verify the registration state of a net_device before invoking its ethtool callback. This allows an asynchronous RDMA port query to potentially access a network device after NETDEV_UNREGI...

CVE-2026-98357

A use-after-free vulnerability exists in the Linux kernel within the IB/isert component. The issue occurs because isert_send_done() hands off certain completions (such as ISTATE_SEND_TASKMGTRSP) to a workqueue without ordering them against teardown. Consequently, isert_wait_conn() can queue relea...

CVE-2026-98356

The Linux kernel contains a vulnerability in the RDMA/bnxt_re driver. Specifically, the function bnxt_re_init_dcb_wq() fails to properly handle a failed memory allocation. This oversight results in the asynchronous DCB handler subsequently calling queue_work() on a NULL pointer , which can lead t...

CVE-2026-98355

The Linux kernel contains a vulnerability in the RDMA/rtrs component where a null pointer dereference can occur. Specifically, if init_path() fails in the client, the cleanup function rtrs_clt_close_conns() may attempt to call event tracing code using clt_path->kobj->name while that name is...

CVE-2026-98354

A memory leak vulnerability exists in the Linux kernel within the RDMA/mad component. The issue occurs in ib_mad_complete_recv() because ib_mad_enforce_security() is executed before the recv_buf is linked to the rmpp_list. If security enforcement fails, the system calls ib_free_recv_mad(), which ...

CVE-2026-98352

The Linux kernel contains a vulnerability in the RDMA/rtrs-clt component where a CQ pool leak occurs when a connection is interrupted. The issue is caused by a race condition in the ADDR_RESOLVED handler: the client may borrow shared CQ credits via ib_cq_pool_get() before the peer is connected. I...

CVE-2026-98353

The Linux kernel contains a vulnerability in the RDMA/erdma subsystem where locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. This occurs because if an interrupt arrives while the create path holds a plain xa_lock , the lookup operation spins indefinitely a...

CVE-2026-98351

The Linux kernel contains a memory leak vulnerability in the virt_wifi component. When a simulated link is disconnected, the virt_wifi_start_xmit() function returns NET_XMIT_DROP without freeing the skb . Because dev_hard_start_xmit() treats this return value as consumed, every packet sent while ...

CVE-2026-98350

The Linux kernel contains a vulnerability in the wifi: brcmfmac: cyw component. The root cause is a failure to zero out auth_status during initialization, which allows garbage data to leak from the stack to the firmware. This occurs specifically when the ssid is shorter than 32 bytes and/or when ...

CVE-2026-98349

The Linux kernel contains a vulnerability in the libipw component where libipw_network_init() and libipw_process_probe_response() fail to properly validate the length of beacon and probe responses. The issue stems from an integer underflow : because stats->len is a u16 and sizeof() is a size_t...

CVE-2026-98347

The Linux kernel contains a race condition in the IB/IPoIB driver where ipoib_ib_dev_flush_light() restores the IPOIB_FLAG_OPER_UP flag after a multicast flush. This restore can conflict with ipoib_ib_dev_down(), potentially leaving the flag set after the device is down. Consequently, ipoib_mcast...

CVE-2026-98348

The Linux kernel contains a vulnerability in the libipw component where the ipw2100 and ipw2200 management receive paths fail to properly validate the length of association responses. Specifically, the function libipw_handle_assoc_resp() performs an unsafe subtraction between a u16 length and a s...

CVE-2026-98346

The Linux kernel contains a vulnerability in the cfg80211 component where the function cfg80211_calculate_bi_data() calls rdev_get_radio_mask() using wdev->netdev. Because wdev->netdev can be NULL for certain network device types, this leads to a crash in mac80211 . The fix involves inverti...

CVE-2026-98345

The Linux kernel contains a vulnerability within the cfg80211 component, specifically in the cfg80211_classify8021d() function. The issue occurs when a frame mimicking an IP packet is transmitted but is too short, causing the DS field to be read incorrectly. This leads to an uninit-value error as...

CVE-2026-98344

The Linux kernel contains a vulnerability in the dmaengine component involving a device kref underflow in dma_chan_put(). The issue occurs because dma_chan_get() only increments the chan->device->ref on the slow path, while dma_chan_put() drops the reference unconditionally. This causes a m...

CVE-2026-98343

The Linux kernel contains a use-after-free vulnerability in the dmaengine component, specifically within the dma_chan_put() and dma_release_channel() functions. The issue occurs because dma_device_put() can drop the last reference on chan->device->ref, triggering dma_device_release() and fr...

CVE-2026-98342

The Linux kernel dmaengine component contains a vulnerability where dma_device_release() unlinks a device using list_del_RCU() and subsequently frees it without ensuring a grace period. This allows concurrent RCU readers in dma_issue_pending_all() to access the device after it has been freed, pot...

CVE-2026-98341

A Use-After-Free (UAF) vulnerability exists in the Linux kernel within the wifi: cfg80211 component. When a wireless interface goes down during an active scan, cfg80211 completes the scan and frees the scan request; however, because cancellation is asynchronous, the driver may still believe it ow...

CVE-2026-98340

The Linux kernel contains a vulnerability in the cfg80211 WiFi stack where the __cfg80211_bss_update() function incorrectly groups hidden BSSes**. Specifically, it may group a probe response for an unknown BSS with an existing entry that lacks beacon elements, creating a group withou...

CVE-2026-98339

The Linux kernel contains a vulnerability in the cfg80211 component where the cfg80211_update_assoc_bss_entry() function fails to properly filter by BSS type when removing stale entries. When an associated Access Point switches to a channel with an existing BSS entry, the system fails to remove e...

CVE-2026-98338

The Linux kernel contains a race condition in the cfg80211 wireless subsystem when joining an IBSS . The issue occurs because the system previously recorded only the BSSID/channel and performed a lookup later; however, a new scan with NL80211_SCAN_FLAG_FLUSH could remove the BSS entry before proc...

CVE-2026-98337

A vulnerability exists in the Linux kernel 's mac80211 wifi subsystem where ROC (Radio Out Channel) work could be started while a scan is in progress. This occurs because pending ROC work might remain when a scan begins, and new ROCs can be added to the list, potentially causing a warning in net/...

CVE-2026-98336

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the system attempts to offload TC (traffic control) setup to drivers for AP_VLAN interfaces . Because these interfaces are purely virtual, the offload attempt is inappropriate and can fail as the AP interface may be u...

CVE-2026-98335

The Linux kernel contains a vulnerability in the mac80211 wifi subsystem where the ieee80211_stop_mesh() function fails to properly abort a channel switch (CSA) when leaving a mesh. Because the function leaves CSA active while releasing the channel context, it results in a null-pointer dereferenc...

CVE-2026-98333

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the radio LED state is not properly reset if the interface bringing up fails. This oversight allows the TPT trigger timer to continue running indefinitely even after a failure, eventually leading to a use-after-free c...

CVE-2026-98334

A vulnerability exists in the Linux kernel 's mac80211 WiFi subsystem where the ieee80211_start_ap() function can set enable_beacon and beacon_int but fail to reset them upon an error. This persistent state can cause a divide error (Oops) in hwsim when scanning attempts to restore beaconing. Addi...

CVE-2026-98332

The Linux kernel contains a vulnerability in the wifi: mac80211 component. The function ieee80211_tdls_oper() can incorrectly operate on an AP station if it is confused for a TDLS peer . This leads to various warnings when the AP station is subsequently removed or at a later point in time. The fi...

CVE-2026-98331

The Linux kernel contains a vulnerability in the mac80211 component where virtual interfaces (vifs) are not consistently removed from the local->interfaces list when a network device (netdev ) is unregistered. This typically occurs when a netns holding a wiphy is destroyed and the move to init...

CVE-2026-98330

The Linux kernel contains a vulnerability in the cfg80211 component where a wiphy object can be left with a garbage netns pointer when a network namespace is destroyed. This occurs because cfg80211_pernet_exit() may fail to move the wiphy back to the initial namespace due to allocation failures ,...

CVE-2026-98329

The Linux kernel contains a vulnerability in the mac80211 component where frames injected on a monitor interface can include a radiotap field requesting a bandwidth wider than the actual operational bandwidth. The system currently passes these requests to the driver, which can trigger a WARN_ON i...

CVE-2026-98328

The Linux kernel contains a vulnerability in the wifi: mac80211 component. The issue occurs because the HE 6 GHz Band Capability element is included in the probe request for every band if 6 GHz is supported, but its size was not consistently added to scan_ies_len . This omission can cause probe r...

CVE-2026-98327

A vulnerability exists in the Linux kernel within the wifi: mac80211: mesh component. The issue occurs because ifmsh->csa is allocated in ieee80211_mesh_csa_beacon() but is only freed in ieee80211_mesh_finish_csa() upon completion of a channel switch. If a user leaves the mesh while a switch i...

CVE-2026-98326

The Linux kernel contains a vulnerability in the wifi: mac80211: mesh component where the ieee80211_join_mesh() function acquires a channel context but fails to release it if the subsequent ieee80211_start_mesh() call fails. This improper handling leads to a warning during interface removal becau...

CVE-2026-98325

The Linux kernel contains a vulnerability in the wifi: mac80211 component where failed socket buffer (SKB) structures were not properly reported to userspace during certain failure paths. The issue stems from the timing of TX information setup; specifically, the skb->cb[] array was not initial...