CVE-2026-98961

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

CVE-2026-98960

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98959

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix xattr replace when multiple xattrs are packed in the same item If we have a btrfsdiritem item that packs multiple xattrs and then we replace the value of one of them with the setxattr2 family of syscalls with another...

CVE-2026-98958

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: account non-AQL frames per peer rather than per link The driver increments wcid-nonaqlpackets when a frame goes to the hardware queue. The completion path decrements the counter again. For an MLO peer, the hardware...

CVE-2026-98957

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7915: disable rx napi when removing device Unloading the mt7915e module with a MT7916 triggers multiples WARN in netifnapidellocked and in pagepooldisabledirectrecycling because the driver does not disable the napi...

CVE-2026-98956

In the Linux kernel, the following vulnerability has been resolved: ASoC: adau1372: allow sleepy powerdown GPIOs gpiodsetvalue emits a WARN when the GPIO provider indicates that it can sleep, as is typical for I2C controlled GPIO expanders. Since the powerdown GPIO is only manipulated in process...

CVE-2026-98955

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of skb-len when computing thoff skbflowdissect computes keycontrol-thoff using: keycontrol-thoff = mintu16, nhoff, skb ? skb-len : hlen; mintu16, ... casts both arguments to u16 before comparin...

CVE-2026-98953

In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlinkrel reference leak when notify work is pending devlinkrelnestedinnotifyworkschedule takes a reference on the devlinkrel for the notify work and then queues the work, ignoring the return value of...

CVE-2026-98954

In the Linux kernel, the following vulnerability has been resolved: net: always dissect GSO packets in virtionethdrtoskb Commit 9e8db5913264 "net: avoid false positives in untrusted gso validation" added a '&& skb-networkheader' check before flow-dissecting GSO packets without...

CVE-2026-98952

In the Linux kernel, the following vulnerability has been resolved: pfcp: make sure the SEID is linear before reading it pfcpencaprecv only makes sure that the UDP header and the 4 byte PFCP header are in the linear area. When the S flag is set, pfcpsessionrecv then reads the 8 byte SEID that...

CVE-2026-98951

In the Linux kernel, the following vulnerability has been resolved: riscv: ptrace: Zero-initialize regset buffers before copyin userregsetcopyin only copies count bytes, so a PTRACESETREGSET request with a short iovlen leaves the rest of the stack buffer uninitialized. In riscvvrset that garbage ...

CVE-2026-98950

In the Linux kernel, the following vulnerability has been resolved: flowdissector: avoid u16 truncation of hlen in bpfflowdissect bpfflowdissect sanitizes the offsets returned by the BPF program with clamptu16, ..., hlen. If hlen is bigger than 65535, the upper bound is truncated before the...

CVE-2026-98948

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumflower: Fix port range register leak in tmpltcreate mlxswspflowertmpltcreate parses a flowclsoffload template into a stack-local struct mlxswspaclruleinfo purely to compute rulei.values.elusage. Parsing can acquire...

CVE-2026-98949

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: Fix reference and vmbo handling in remap When a map overlaps part of an existing mapping, pvrvmgpuvaremap splits the mapping into prev/next parts covering what the request did not take, instead of creating...

CVE-2026-98947

In the Linux kernel, the following vulnerability has been resolved: vsock: Fix memory leak in vmcitransportrecvdgramcb During the closure of a datagram socket, the vmcitransportrecvdgramcb function may be called, which will add the packets to the socket's backlog; then, after the receive queue is...

CVE-2026-98946

In the Linux kernel, the following vulnerability has been resolved: drm/vc4: Disable the V3D interrupt across runtime suspend vc4irqdisable masks the V3D interrupt sources and then calls synchronizeirq before the V3D is powered down. However, by itself, this is not enough to quiesce the interrupt...

CVE-2026-98945

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Rearrange teardown sequence This fixes a narrow window during the teardown sequence where callbacks could still be scheduled during cleanup that would then have a dangling pointer to the now-freed steam struct. This...

CVE-2026-98944

In the Linux kernel, the following vulnerability has been resolved: HID: steam: Refactor registration This refactors and simplifies the registration/unregistration flow. Since we now only perform registration when the client isn't opened anymore, the logic for handling that can be removed, and th...

CVE-2026-98943

Removed by vendor...

CVE-2026-98942

In the Linux kernel, the following vulnerability has been resolved: schedext: Build the cid tables privately and publish them with RCU The cid tables are visible to the cid kfuncs while being modified: the first enable publishes the global pointers before filling them, ops.initcids overrides...

CVE-2026-98941

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 "ext4: add checks for large folio incompatibilities when BS PS" disables large folios at mount time if the "encrypt" feature is set. However, enabling that...

CVE-2026-98940

In the Linux kernel, the following vulnerability has been resolved: ASoC: qcom: lpass-cpu: use DAI table index for playback constraints The DAI ID is a hardware port ID and is not necessarily the index of the corresponding entry in variant-daidriver. When configuring a DAI with...

CVE-2026-98939

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Drop unnecessary PMD page copy when freeing On a box with a discrete GPU, lockdep reports a possible deadlock as soon as kswapd shrinks the TTM page pool. The immediate cause is an x86 commit that added an mmapreadlock to...

CVE-2026-98938

In the Linux kernel, the following vulnerability has been resolved: rust: irq: pass RegistrationInner as cookie to requestirq With commit ba268514ea14 "rust: devres: fix race condition due to nesting", Devres::new returns Result by value instead of initializing in-place via PinInit. Because...

CVE-2026-98937

In the Linux kernel, the following vulnerability has been resolved: perf/core: Check kernel access when kernel callchains are requested perfeventopen currently gates perfallowkernel only on !attr.excludekernel. However, users can still request kernel callchain collection with...

CVE-2026-98936

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: reset ar-numstations on hardware start When multiple hw restart occurs, we end up in a situation where we cannot accept new stations / mesh peers. This seems to be the 'numstations' in 'struct ath11k' that did not g...

CVE-2026-98935

In the Linux kernel, the following vulnerability has been resolved: rtc: dev: zero-initialize struct rtcwkalrm to prevent information leak The struct rtcwkalrm has padding holes after the 'pending' member. When returned to userspace via the RTCWKALRMRD ioctl, uninitialized kernel stack data...

CVE-2026-98934

In the Linux kernel, the following vulnerability has been resolved: ipv6: sr: use skbgethashnet in seg6makeflowlabel Since commit d58e468b1112 "flowdissector: implements flow dissector BPF hook" skbflowdissect needs a net pointer, either from skb-dev, skb-sk, or since commit 3cbf4ffba5ee "net:...

CVE-2026-98933

In the Linux kernel, the following vulnerability has been resolved: usb: hub: use shorter 120ms post resume hold for SS root hubs Holding a USB3 hub PM runtime reference for 200ms at hub resume triggers an AMD platform issue. Users running Android adb report crashes after adb has been polling and...

CVE-2026-98932

In the Linux kernel, the following vulnerability has been resolved: EDAC/altera: Fix use-after-free in error paths In both altredaca10deviceadd and altrportbsetup, the error path freed the dci structure before releasing the devres group. Since the managed single and double bit IRQ handlers use...

CVE-2026-98931

In the Linux kernel, the following vulnerability has been resolved: mtd: spinand: fix NULL pointer dereference with no ECC engine When "nand-no-ecc-engine" is set in DT, nanddevgeteccengine takes the NANDECCENGINETYPENONE path and returns success while leaving nand-ecc.engine NULL. The SPI-NAND...

CVE-2026-98930

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Fix IRQ injection with SIGP Stop and Store Status When injectsigpstop is called for a Stop and Store Status operation, if the vCPU is running, the interrupt is marked as pending and the status is stored by the thread...

CVE-2026-98929

In the Linux kernel, the following vulnerability has been resolved: macsec: initialize SecY before registering the netdevice Creating a MACsec device with MAC offload over an LRO-capable lower device triggers a warning in rtmsgifinfobuildskb when IPv4 forwarding is enabled by default...

CVE-2026-98928

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Derive GUESTHASSVE from the SVE feature bit at EL2 pkvminitfeaturesfromhost takes KVMARCHFLAGGUESTHASSVE and KVMARMVCPUSVE from the host separately, but pkvmvcpuinitsve tests the bit while vcpuhassve reads the flag. A...

CVE-2026-98927

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix life cycle of the nestedmmus array The nestedmmus array holds the shadow page tables that are used when a guest is running a nested context. These structures are allocated on VCPUINIT for whole guest, which...

CVE-2026-98926

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Remove sink usage from DPMS Why stream-sink is optional and can be null, so should always be checked before dereference. Additionally, most of its usage in DPMS sequences is for stream-sink-link, which can be...

CVE-2026-98925

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Fix self-redirect copiedseq double-counting When a BPF streamverdict program redirects an skb back to the same socket self-redirect with BPFFINGRESS, skpsockverdictapply calls tcpeatskb which advances tcpsk-copiedse...

CVE-2026-98924

In the Linux kernel, the following vulnerability has been resolved: fs: avoid repeated scans in evictinodes We observed hung tasks when users attempted to unmount a filesystem after its disk had been removed while still in use. During device removal, fsbdevmarkdead calls evictinodes while holding...

CVE-2026-98923

In the Linux kernel, the following vulnerability has been resolved: arm64: io: Reject non-user protection in ioremapprot Mapping a stack-top page via /dev/mem with PROTNONE and then reading that process's /proc//cmdline triggers a spurious WARN in ioremapprot through genericaccessphys: WARNING:...

CVE-2026-98922

In the Linux kernel, the following vulnerability has been resolved: net: emac: move setting of netops to fix crash fixes the following crash on driver initialization: |BUG: Kernel NULL pointer dereference on read at 0x00000158 |Faulting instruction address: 0xc0566b40 |Oops: Kernel access of bad...

CVE-2026-98921

In the Linux kernel, the following vulnerability has been resolved: ovl: fix UAF in ovldomkdir debug print ovldomkdir prints the input dentry with %pd after vfsmkdir. Since commit fe497f0759e0 "VFS: change vfsmkdir to unlock on failure.", vfsmkdir calls endcreating on the input dentry on failure...

CVE-2026-98920

In the Linux kernel, the following vulnerability has been resolved: netfs: Fix missing alloc tagging of direct mempool allocations Commit 1d78d56c43ef "netfs: Fix folioqueue ENOMEM in writeback by adding a mempool" added a mempool for the folioqueues and made the request, subrequest and folioqueu...

CVE-2026-98919

In the Linux kernel, the following vulnerability has been resolved: drm/xe: harden adjustidledly against divide-by-zero and overflow adjustidledly has several corner-case issues flagged during review: 1. If xegtclockinit failed to recognise the crystal clock, gt-info.timestampbase is 0, which mak...

CVE-2026-98918

In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: use a page-aligned address in damonptepmkold damonvaprepareaccesscheck picks a random byte address within the region and stores it in r-samplingaddr. damonvamkold passes it into a page table walk, which hands...

CVE-2026-98917

In the Linux kernel, the following vulnerability has been resolved: parisc: Increase kernel stack size to 32kb For 64-bit Linux kernels, increase the default kernel stack size THREADSIZEORDER to 32 kB, in order to avoid kernel crashes which have been triggered recently when building the debian vt...

CVE-2026-98916

In the Linux kernel, the following vulnerability has been resolved: wifi: nl80211: check link is beaconing for color change When trying to do a color change, validate that the link is beaconing first, to avoid calling the driver with an invalid link...

CVE-2026-98915

In the Linux kernel, the following vulnerability has been resolved: media: video-i2c: use vb2videounregisterdevice on driver removal The driver uses vb2foprelease as its file release operation, so vb2videounregisterdevice should be used instead of videounregisterdevice during driver removal. This...

CVE-2026-98914

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: cap ATOM command table nesting depth Cap nesting at 32 levels with executedepth and return -ELOOP when exceeded...

CVE-2026-98913

In the Linux kernel, the following vulnerability has been resolved: net: thunderx: fix PTP device ref leak in nicvfprobe caviumptpget acquires a reference to the PTP PCI device through pcigetdevice. If any initialization step fails after caviumptpget, the PTP PCI device reference is leaked. Add a...

CVE-2026-98912

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Reject reads that cannot fit the next event sndseqossread checks whether the next queued OSS sequencer event fits in the remaining userspace buffer before removing it from the read queue. The check is inverted. It...