CVE-2026-98829 wifi: mac80211: drop oversized fragments to avoid extra_len overflow

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: drop oversized fragments to avoid extralen overflow In ieee80211rxhdefragment, fragment payloads are accumulated into entry-extralen as subsequent fragments arrive: entry-extralen += rx-skb-len; When the final...

CVE-2026-98828 wifi: ath9k: reject short WMI command responses

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9k: reject short WMI command responses ath9kwmirspcallback removes the validated WMI header and copies the number of bytes expected by the waiting command into its response buffer. A device response shorter than that...

CVE-2026-98827 wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: bound TX aggregation to MAXTXBUFSIZE hifusbtx dequeues up to MAXTXAGGRNUM 20 frames into a single txbuf of MAXTXBUFSIZE 32768 bytes, limiting the batch by record count but never by cumulative byte length. With lar...

CVE-2026-98826 rtc: ac100: Fix clock provider use-after-free on probe failure

In the Linux kernel, the following vulnerability has been resolved: rtc: ac100: Fix clock provider use-after-free on probe failure ac100rtcregisterclks registers the RTC-32k clock with clkhwregisterfixedrate and the clock provider with ofclkaddhwprovider. Neither is device managed, and both are...

CVE-2026-98825 rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()

In the Linux kernel, the following vulnerability has been resolved: rtc: mpfs: fix unchecked devmclkget error pointer in probe devmclkget&pdev-dev, "rtcref"'s return value was passed straight into clkgetrate without checking it for an error first, unlike the "rtc" clock a few lines above which is...

CVE-2026-98824 wifi: mac80211: validate TX status rate metadata

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: validate TX status rate metadata minstrelhttxstatus converts the HT/VHT rate reported in a TX status into a group and rate index and uses those to index the minstrelht rate tables. The existing validation only...

CVE-2026-98823 wifi: cfg80211: preserve hidden-group beacon IE ownership

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: preserve hidden-group beacon IE ownership A hidden-group probe-response entry borrows its beacon IEs from the group's beacon entry. cfg80211updateassocbssentry can pass such an entry to cfg80211updateknownbss when...

CVE-2026-98822 wifi: mac80211: prevent AP VLAN tx from other interfaces

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: prevent AP VLAN tx from other interfaces Since the station lookup was factored out of ieee80211buildhdr, ieee80211lookuprasta uses stainfogetbss for all AP and AP VLAN frames, not only for control port frames. A...

CVE-2026-98821 block: reject polled dio with user integrity metadata

In the Linux kernel, the following vulnerability has been resolved: block: reject polled dio with user integrity metadata IOCBHASMETADATA leaves iocb-private as a uiometa, while iocbbioiopoll expects a bio. Since 2729a60bbfb9, metadata I/O always uses blkdevdirectIO, which never publishes the bio...

CVE-2026-98820 blk-mq: set RQF_USE_SCHED when the operation is known

In the Linux kernel, the following vulnerability has been resolved: blk-mq: set RQFUSESCHED when the operation is known The cached requests are allocated for one operation but can be handed out for another. A passthrough command has RQFUSESCHED cleared, so using those flags for a subsequent...

CVE-2026-98819 Bluetooth: btintel: validate DDC record lengths

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintel: validate DDC record lengths Parse DDC record lengths in unsigned storage so 0xFF does not wrap. Reject records smaller than the mandatory three-byte header, records exceeding U8MAX, and records exceeding...

CVE-2026-98818 mm/slab: do not wake up kswapd in __kfree_rcu_sheaf()

In the Linux kernel, the following vulnerability has been resolved: mm/slab: do not wake up kswapd in kfreercusheaf Since kfreercu can be called under pilock a raw spinlock in the scheduler, kfreercu itself should never allocate memory with GFPKSWAPDRECLAIM as waking up kswapd ends up acquiring...

CVE-2026-98817 ASoC: SDCA: Add better pm_runtime error handling in func probe

In the Linux kernel, the following vulnerability has been resolved: ASoC: SDCA: Add better pmruntime error handling in func probe Add a common error path in probe that balances the runtime PM reference...

CVE-2026-98816 bpf: Fix overflow of jump offset in constant blinding

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix overflow of jump offset in constant blinding bpfjitblindinsn rewrites 'if rX op imm goto off' into: AX = imm ^ rnd AX ^= rnd if rX op AX goto off and subtracts 2 from off when the jump is backward. off is s16, so -32767...

CVE-2026-98815 nvme: fix cdev lifetime

In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev lifetime in 0 - the code there is heavily based on the NVMe code. Currently the NS head .open and .release fileoperations methods take and put a...

CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been...

CVE-2026-98813 bpf: Hold map BTF for the memory allocator destructor record

In the Linux kernel, the following vulnerability has been resolved: bpf: Hold map BTF for the memory allocator destructor record bpfmasetdtor duplicates map-record so that the bpfmemalloc destructor can release the special fields of hash and rhash map elements once the allocator frees them for...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98810 wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211monitorselectqueue ieee80211monitorselectqueue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However, skb-l...

CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98806 octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

CVE-2026-98804 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool...

CVE-2026-98805 tipc: prevent GCM nonce reuse on peer key changes

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

CVE-2026-98803 net: stmmac: fix rx Scatter-Gather support

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

CVE-2026-98802 seg6: ensure packet data is writable before modifying SRH and IPv6 DA

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...

CVE-2026-98800 bpf: Wait for an RCU tasks grace period before freeing trampoline progs

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

CVE-2026-98799 bpf: Skip detached progs in trampoline images that are still in use

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

CVE-2026-98798 net: bcmgenet: fix NULL dereference in set_coalesce before first open

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98794 ipvs: filter some flags received in the backup server

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98792 netfilter: flowtable: generalize pending status bit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98788 futex: Fix private hash use-after-free on resize

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98787 bpf: Fix missing migration protection in __rhtab_map_lookup_and_delete_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

CVE-2026-98785 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98786 drm/amd/display: guard dc_sink dereferences in MST mode validation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98784 drm/amdgpu/gfx6: fix firmware leak on teardown

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfxv60initmicrocode is not released when the GFX block is torn down, leaking the firmware resources. Add gfxv60freemicrocode and call it from gfxv60swfini t...

CVE-2026-98783 drm/mediatek: Add missing IS_ERR check for ovl_adaptor platform device

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

CVE-2026-98782 drm/mediatek: Fix ovl adaptor platform device leak

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor platform device leak mtkdrmprobe creates an OVL adaptor platform device with platformdeviceregisterdata when the display pipeline requires the OVL adaptor. If a later initialization step fails, the...

CVE-2026-98781 drm/mediatek: Fix pdev reference leak in mtk_drm_bind()

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex device via offinddevicebynode, without ever dropping it: mtkdrmunbin...

CVE-2026-98780 drm/amdgpu: fix IP instance memory leak on kobject add failure

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...