CVE-2026-98014

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, prevent mclist repopulation during vport disable In mlx5eswvportdisable, move eswapplyvportrxmode ahead of eswvportchangehandlelocked so vport-allmultirule is NULL before the change handler observes it. During...

CVE-2026-98012

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

CVE-2026-98015

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

CVE-2026-98001

In the Linux kernel, the following vulnerability has been resolved: hwmon: ltc4282 Make sure clkinitdata is fully initialized The clkinitdata structure contains several mutually-exclusive members for different methods to specify the possible parents of a clock, prompting drivers to initialize onl...

CVE-2026-98004

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

CVE-2026-98006

In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: Decoupling ep1inurb in caiaq dev The epqinurb object belonging to the caiaq device is coupled within the struct sndusbcaiaqdev. After usbsubmiturbepqinurb, GFPKERNEL executes successfully, epqinurb is successfully...

CVE-2026-97998

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 - 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspac...

CVE-2026-98000

In the Linux kernel, the following vulnerability has been resolved: hwmon: Fix potential UAF in pecstore Sashiko reports: In pecstore, a guardmutex&hwdev-lock is taken. If the chip write operation returns an error other than -EOPNOTSUPP, the code jumps to the put label, which calls putdevicehdev...

CVE-2026-98003

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Do not reallocate GA log buffers on resume Commit c5e1a1eb9279 "iommu/amd: Simplify and Consolidate Virtual APIC AVIC Enablement" moved the GA log allocation from iommuinitpci to enableiommusvapic, which is called on...

CVE-2026-98002

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

CVE-2026-98005

In the Linux kernel, the following vulnerability has been resolved: erofs: delimit inodeshare cache key components Previously, inodeshare keys were encoded as follows: fingerprint || domainid It would be better to have a separator between the fingerprint and domain ID so that the fingerprint won'...

CVE-2026-98007

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject non-scalar bpfloop iteration counts bpfloop declares its nrloops argument as ARGANYTHING. Privileged programs may pass pointer values to such arguments, so checkfuncarg lets a pointer-valued R1 reach the helper-specif...

CVE-2026-97990

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97989

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

CVE-2026-97991

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

CVE-2026-97994

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97992

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: protect configctx from being freed under the config callback vhostvdpaconfigcb loads v-configctx and signals it without taking a reference and without holding any lock: struct eventfdctx configctx = v-configctx; if...

CVE-2026-97993

In the Linux kernel, the following vulnerability has been resolved: vhost-vdpa: don't install the eventfdctxfdget error in configctx vhostvdpasetconfigcall swaps the eventfdctxfdget return value into v-configctx before checking it, so on failure the field briefly holds an ERRPTR: ctx = fd ==...

CVE-2026-97995

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every virtqueue and passes leftover cookies to freebuf, which treats them as...

CVE-2026-97996

In the Linux kernel, the following vulnerability has been resolved: virtio: fix use-after-free in unregistervirtiodevice deviceunregister is devicedel plus putdevice. When the caller holds no extra reference, that drops the last one and runs the release callback, which for several transports free...

CVE-2026-97997

In the Linux kernel, the following vulnerability has been resolved: virtioring: fix stale descriptor flags after a failed packed add In a packed ring the AVAIL and USED bits sit in the descriptor itself, so writing them makes that descriptor available. Those bit combinations flip meaning on every...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

CVE-2026-97988

In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIOFACCESSPLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale rin...

CVE-2026-97980

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...

CVE-2026-97983

In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...

CVE-2026-97985

In the Linux kernel, the following vulnerability has been resolved: afunix: Update last skb marker in manageoob. Fahad Alharbi reported that blocking recvMSGPEEK could hog CPU due to OOB skb. In the following cases, manageoob skips OOB skbs and returns NULL for the last recvMSGPEEK:...

CVE-2026-97986

In the Linux kernel, the following vulnerability has been resolved: virtioinput: stop callbacks before unregistering input device virtinputremove unregisters the input device before resetting the virtio device. virtinputrecvevents drops vi-lock around inputevent, so clearing vi-ready does not sto...

CVE-2026-97982

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...

CVE-2026-97987

In the Linux kernel, the following vulnerability has been resolved: virtioinput: reset device if inputregisterdevice fails Probe marks the device DRIVEROK with virtiodeviceready before calling inputregisterdevice. If registration fails, the error path cleared vi-ready and called delvqs while the...

CVE-2026-97972

In the Linux kernel, the following vulnerability has been resolved: net: macb: put the "mdio" child node reference on success macbmiiinit holds the reference returned by ofgetchildbyname for macbmdiobusregister and drops it only on the error paths, so every successful probe leaks a node reference...

CVE-2026-97973

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff or...

CVE-2026-97975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisysfs: Fix NULL pointer dereference in devicedel A NULL pointer dereference in klistput occurs when a child device such as a BNEP network device in bnepsession is concurrently being unregistered while hciconndelsysf...

CVE-2026-97977

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btusb: Fix UAF of btusbdata by rxwork btusbclose and btusbflush cancel data-rxwork with the asynchronous canceldelayedwork, so if btusbrxwork is already running on another CPU it keeps running after the cancel returns...

CVE-2026-97978

In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...

CVE-2026-97979

In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...

CVE-2026-97974

In the Linux kernel, the following vulnerability has been resolved: ipv6: null-check fib6node before accessing in ip6delrtsiblings syzbot reported a null-ptr-deref in ip6delrtsiblings 0. The stack trace hinted towards a null dereference of rt-fib6node when fn-leaf is accessed in ip6delrtsiblings...

CVE-2026-97976

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in...

CVE-2026-97971

In the Linux kernel, the following vulnerability has been resolved: nstree: check listing permission before taking a namespace reference legitimizens takes a reference on the candidate namespace before maylistns has decided whether the caller may see it. The freensput cleanup on the denied path c...

CVE-2026-97965

In the Linux kernel, the following vulnerability has been resolved: vxlan: initialize md in vxlanxmitone If a VXLAN device is configured with both VXLANFCOLLECTMETADATA and VXLANFGBP, and a packet is transmitted through it using an external iptunnelinfo that lacks the IPTUNNELVXLANOPTBIT flag, md...

CVE-2026-97964

In the Linux kernel, the following vulnerability has been resolved: pppsynctty: ensure a writeable skb header pppsynctxmunge checks headroom before prepending the address and control bytes, but does not ensure that the skb header is writable. A received skb can reach this function through PPP...

CVE-2026-97963

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptplock at probe time priv-ptplock is only initialized in stmmacptpregister, which runs during stmmacopen. However, the lock is also used while the interface is down and has never been opened:...

CVE-2026-97970

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Avoid division by zero clkgetrate could return 0. Avoid a division by zero panic...

CVE-2026-97966

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: reset HTB scheduler topology before freeing queues HTB offload programs NIXAFTLxXTOPOLOGY on QoS-allocated scheduler queues via otx2qostxschqsetparenttopology, but teardown freed those queues without clearing...

CVE-2026-97967

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Remove debugfs entries when probe fails ccpdebugfsinit registers debugfs files whose private data is the devm allocated ccp. If hwmondeviceregisterwithinfo fails right after it, ccpprobe returns without removi...

CVE-2026-97969

In the Linux kernel, the following vulnerability has been resolved: watchdog: msc313e: Fix clock leak and spurious timer in settimeout msc313ewdtsettimeout unconditionally calls msc313ewdtstart which introduces two severe bugs: 1. If the watchdog is already active, calling start again will increa...

CVE-2026-97968

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Create debugfs entries after hwmon registration ccpdebugfsinit registers debugfs files whose private data is the devm allocated ccp. It runs before hwmondeviceregisterwithinfo, so when that registration fails,...

CVE-2026-97962

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97956

In the Linux kernel, the following vulnerability has been resolved: net: netfailover: Fix the deadlock in netfailoverslavenamechange This is a sibling fix of commit b84c5632c7b3 "net: netfailover: Fix the deadlock in slave register". There is netdevlockops in the upper callers, so using netifopen...