CVE-2026-97500 wifi: rtw89: phy: check length before parsing PHY status IE

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

CVE-2026-97499 coresight: perf: Retrieve path and source from event data

In the Linux kernel, the following vulnerability has been resolved: coresight: perf: Retrieve path and source from event data ETM perf callbacks currently use the per-CPU csdevsrc pointer, which can race with updates during device registration and unregistration. The AUX setup already builds and...

CVE-2026-97498 drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/userq: pin mqd and fw object bo to avoid eviction mqd and fw objects are queue core objects which should remain valid and never be unmapped and evicted for user queues to work properly. During eviction if these buffers...

CVE-2026-97497 drm/amdkfd: Check bounds for allocate_sdma_queue restore_sdma_id

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds for allocatesdmaqueue restoresdmaid allocatesdmaqueue has an option where the sdma queue id can be specified used by CRIU. We weren't bounds-checking that value. Confirm it's less than the maximum number ...

CVE-2026-97496 drm/amdkfd: Fix OOB memory exposure in get_wave_state()

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Fix OOB memory exposure in getwavestate The getwavestate function for v9 trusts cphqdcntlstacksize and cphqdcntlstackoffset values read directly from the MQD, which are written by GPU microcode and fully...

CVE-2026-97495 drm/amdkfd: Check bounds on allocate_doorbell

In the Linux kernel, the following vulnerability has been resolved: drm/amdkfd: Check bounds on allocatedoorbell allocateddoorbell has an option to set the doorbell id to a specific value used by CRIU. This value was not bounds checked. Check to confirm it's less than KFDMAXNUMOFQUEUESPERPROCESS...

CVE-2026-97493 drm/amdgpu: Bound GPIO I2C table entry count from VBIOS

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: Bound GPIO I2C table entry count from VBIOS Reject undersized tables and cap the derived entry count to AMDGPUMAXI2CBUS so we do not overrun adev-i2cbus or walk an absurd number of entries on corrupt size fields...

CVE-2026-97494 drm/amdgpu: validate and share PSP fw_pri_buf copies via psp_copy_fw

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: validate and share PSP fwpribuf copies via pspcopyfw Change pspcopyfw from void to int: return -ENODEV when drmdeventer fails, and -EINVAL when the image size is zero or larger than the 1 MiB PSP private buffer. Repla...

CVE-2026-97492 wifi: mac80211: don't call ieee80211_handle_reconfig_failure when not needed

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: don't call ieee80211handlereconfigfailure when not needed In case reconfiguration of NAN fails, we call ieee80211handlereconfigfailure, that marks all interfaces as not in the driver. Then, at the error path of th...

CVE-2026-97491 net/rds: Don't sleep inside rds_ib_conn_path_shutdown

In the Linux kernel, the following vulnerability has been resolved: net/rds: Don't sleep inside rdsibconnpathshutdown New rds rdma self tests exposed a hang when tearing down the ib network configs. This is caused by the shutdown worker thread sleeping on the waitevent call, which blocks other wo...

CVE-2026-97490 affs: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: affs: handle setblocksize failures affs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97489 bfs: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: bfs: handle setblocksize failures bfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97488 qnx4: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: qnx4: handle setblocksize failures qnx4 uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97487 jfs: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: jfs: handle setblocksize failures jfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97486 hpfs: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: hpfs: handle setblocksize failures hpfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97485 omfs: handle set_blocksize failures

In the Linux kernel, the following vulnerability has been resolved: omfs: handle setblocksize failures omfs uses bufferheads, which don't handle block size PAGESIZE well. Without this, mounting we will hit the BUGONoffset = foliosizefolio; in foliosetbh on the first breadgfp call...

CVE-2026-97483 usb: core: hcd: fix possible deadlock in rh control transfers

In the Linux kernel, the following vulnerability has been resolved: usb: core: hcd: fix possible deadlock in rh control transfers From within the SCSI error handler memory allocations must not trigger IO. Handling errors in UAS and the storage driver may involve resetting a device. The thread doi...

CVE-2026-97484 usbip: vhci_hcd: fix NULL deref in status_show_vhci

In the Linux kernel, the following vulnerability has been resolved: usbip: vhcihcd: fix NULL deref in statusshowvhci platformgetdrvdata can return NULL if a VHCI host controller's probe failed e.g. due to USB bus number exhaustion. statusshowvhci checked for a NULL pdev but not for a NULL hcd...

CVE-2026-97482 usb: gadget: goku_udc: avoid NULL deref of dev->driver in INT_USBRESET log

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: gokuudc: avoid NULL deref of dev-driver in INTUSBRESET log gokuirq handles a number of bus events under a single ep0 path. It already guards the gadget driver suspend/resume callbacks against a NULL -driver: if...

CVE-2026-97481 serial: 8250: fix possible ISR soft lockup

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: fix possible ISR soft lockup There are rare cases in which the host gets stuck in the ISR because it is flooded with messages during the startup phase. The reason for the soft lockup in the ISR is the missing FIFO...

CVE-2026-97480 tty: serial: 8250: protect against NULL uart->port.dev in register

In the Linux kernel, the following vulnerability has been resolved: tty: serial: 8250: protect against NULL uart-port.dev in register serial8250register8250port conditionally copies uart-port.dev from up-port.dev only when up-port.dev is non-NULL: if up-port.dev uart-port.dev = up-port.dev; ... S...

CVE-2026-97479 driver core: Avoid warning when removing a device while its supplier is unbinding

In the Linux kernel, the following vulnerability has been resolved: driver core: Avoid warning when removing a device while its supplier is unbinding During driver removal, the following warning can appear: WARNING: CPU: 1 PID: 139 at drivers/base/core.c:1497 devicelinksnodriver+0xcc/0xfc ... Cal...

CVE-2026-97478 virt: acrn: Fix irqfd use-after-free during eventfd shutdown

In the Linux kernel, the following vulnerability has been resolved: virt: acrn: Fix irqfd use-after-free during eventfd shutdown acrnirqfddeassign and the eventfd EPOLLHUP wakeup can race and free the same struct hsmirqfd: CPU0 CPU1 ---- ---- eventfdrelease wakeuppollEPOLLHUP hsmirqfdwakeup...

CVE-2026-97477 RDMA/counter: Fix num_counters leak on bind_qp failure in alloc_and_bind()

In the Linux kernel, the following vulnerability has been resolved: RDMA/counter: Fix numcounters leak on bindqp failure in allocandbind When rdmacounterbindqp fails in allocandbind, the error path jumps to errmode which frees the counter without decrementing portcounter-numcounters. The only pla...

CVE-2026-97476 rds: filter RDS_INFO_* getsockopt by caller's netns

In the Linux kernel, the following vulnerability has been resolved: rds: filter RDSINFO getsockopt by caller's netns The RDSINFO family of getsockopt2 options reads several file-scope global lists that are not per-netns: rdssockinfo / rds6sockinfo, rdssockincinfo / rds6sockincinfo - rdssocklist...

CVE-2026-97475 thermal/drivers/tegra/soctherma: Switch to devm cooling device registration

In the Linux kernel, the following vulnerability has been resolved: thermal/drivers/tegra/soctherma: Switch to devm cooling device registration Use devmthermalofcoolingdeviceregister to simplify resource management and avoid manual cleanup in error paths. As a side effect this change has the...

CVE-2026-97474 wifi: iwlwifi: mld: purge async notifications upon nic error

In the Linux kernel, the following vulnerability has been resolved: wifi: iwlwifi: mld: purge async notifications upon nic error This fixes a kernel panic in reconfig failure: 1. we have a BSS connection 2. we have a NAN connection 3. FW error occurs 4. reconfig restores the BSS connection 5...

CVE-2026-97473 powercap: intel_rapl: Fix memory leak in rapl_add_package_cpuslocked()

In the Linux kernel, the following vulnerability has been resolved: powercap: intelrapl: Fix memory leak in rapladdpackagecpuslocked When topologyphysicalpackageid/topologylogicaldieid returns a negative value, rapladdpackagecpuslocked returns ERRPTR-EINVAL directly without freeing the raplpackag...

CVE-2026-97472 ipv6: addrconf: fix temp address generation after prefix deprecation

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire and...

CVE-2026-97456 ACPICA: Fix condition check in acpi_ps_parse_loop()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix condition check in acpipsparseloop Fix condition check for AMLELSEOP in acpipsparseloop to prevent out-of-bounds access...

CVE-2026-97455 ACPICA: Fix use-after-free in acpi_ds_terminate_control_method()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix use-after-free in acpidsterminatecontrolmethod Fix use-after-free issue in acpidsterminatecontrolmethod by clearing references to method locals and arguments...

CVE-2026-97454 ACPICA: add boundary checks in acpi_ps_get_next_field()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in acpipsgetnextfield Add boundary checks in acpipsgetnextfield to prevent out-of-bounds access...

CVE-2026-97453 ACPICA: validate byte_count in acpi_ps_get_next_package_length()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate bytecount in acpipsgetnextpackagelength Validate package length reading in acpipsgetnextpackagelength...

CVE-2026-97452 ACPICA: Prevent adding invalid references

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Prevent adding invalid references Prevent adding references for local, argument, and debug objects in acpiutcopysimpleobject...

CVE-2026-97451 ACPICA: Fix integer overflow in acpi_ex_opcode_3A_1T_1R() (mid_op)

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix integer overflow in acpiexopcode3A1T1R midop Add overflow check for Index + Length to prevent integer overflow when calculating the truncation length. This prevents negative size parameter being passed to memcpy...

CVE-2026-97450 ACPICA: validate handler object type in two places

In the Linux kernel, the following vulnerability has been resolved: ACPICA: validate handler object type in two places ACPICA: validate handler object type in acpievhasdefaulthandler and acpievfindregionhandler...

CVE-2026-97449 ACPICA: Add package limit checks in parser functions

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add package limit checks in parser functions Add package limit checks in parser functions to prevent out-of-bounds access...

CVE-2026-97448 ACPICA: Add validation for node in acpi_ns_build_normalized_path()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Add validation for node in acpinsbuildnormalizedpath Add validation for node in acpinsbuildnormalizedpath to prevent use-after-free vulnerabilities...

CVE-2026-97447 ACPICA: Enhance OEM ID and Table ID validation in acpi_ex_load_table_op()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance OEM ID and Table ID validation in acpiexloadtableop Enhance OEM ID and Table ID validation in acpiexloadtableop to prevent buffer overflows...

CVE-2026-97446 ACPICA: Fix NULL pointer dereference in acpi_ns_custom_package()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Fix NULL pointer dereference in acpinscustompackage acpinscustompackage unconditionally dereferences the first element of the package to read the BIX version number, without checking for NULL: if Elements-Common.Type !=...

CVE-2026-97445 ACPICA: Enhance buffer validation in acpi_ut_walk_aml_resources()

In the Linux kernel, the following vulnerability has been resolved: ACPICA: Enhance buffer validation in acpiutwalkamlresources Enhance buffer validation in acpiutwalkamlresources to prevent buffer overflows...

CVE-2026-97444 ACPICA: add boundary checks in two places

In the Linux kernel, the following vulnerability has been resolved: ACPICA: add boundary checks in two places Add boundary checks in acpipsgetnextnamestring and acpipspeekopcode to prevent out-of-bounds access...

CVE-2026-97443 perf/ftrace: Fix WARNING in __unregister_ftrace_function

In the Linux kernel, the following vulnerability has been resolved: perf/ftrace: Fix WARNING in unregisterftracefunction perfftracefunctionunregister unconditionally calls unregisterftracefunction without checking whether the ftraceops was ever successfully registered. This triggers a WARNON in...

CVE-2026-97442 wifi: ath11k: fix invalid data access in ath11k_dp_rx_h_undecap_nwifi

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: fix invalid data access in ath11kdprxhundecapnwifi In certain cases, hardware might provide packets with a length greater than the maximum native Wi-Fi header length. This can lead to accessing and modifying fields ...

CVE-2026-97441 ata: ahci: fail probe if BAR too small for claimed ports

In the Linux kernel, the following vulnerability has been resolved: ata: ahci: fail probe if BAR too small for claimed ports When an AHCI controller is disabled in BIOS, its HOSTCAP register may contain a bogus value, e.g. 0xFFFFFFFF. Since CAP.NP Number of Ports is a zeroes based 5-bit register...

CVE-2026-97440 net: qrtr: fix node refcount leak on ctrl packet alloc failure

In the Linux kernel, the following vulnerability has been resolved: net: qrtr: fix node refcount leak on ctrl packet alloc failure qrtrsendresumetx calls qrtrnodelookup which takes a reference on the returned node. If the subsequent call to qrtrallocctrlpacket fails due to memory allocation...

CVE-2026-97439 fs/ntfs3: preserve non-DOS attribute bits in system.dos_attrib

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: preserve non-DOS attribute bits in system.dosattrib BUG A corrupted ntfs3 image can hit a NULL function pointer call in genericperformwrite after toggling system.ntfsattrib and then overwriting system.dosattrib on the...

CVE-2026-97438 fs/ntfs3: validate index entry key bounds

In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: validate index entry key bounds BUG A malformed NTFS directory index entry can advertise a keysize larger than the bytes actually present in its NTFSDE payload. Directory lookup then passes that malformed key to...

CVE-2026-97437 ntfs3: fix out-of-bounds read in ntfs_dir_emit() and hdr_find_e()

In the Linux kernel, the following vulnerability has been resolved: ntfs3: fix out-of-bounds read in ntfsdiremit and hdrfinde The bounds check in ntfsdiremit compares fname-namelen a character count against e-size a byte count without accounting for the 2-byte-per-character UTF-16LE encoding or t...

CVE-2026-97436 dpaa2-switch: rework FDB management on the bridge leave path

In the Linux kernel, the following vulnerability has been resolved: dpaa2-switch: rework FDB management on the bridge leave path On bridge leave, the dpaa2switchportsetfdb function always allocates a new FDB for the port which is becoming standalone. In case no FDB is found, then the port leaving...