CVE-2026-97596

In the Linux kernel, the following vulnerability has been resolved: ipvs: reject invalid states in connection template sync records IPVS sync receivers validate protocol states before creating or updating a connection. For connection templates, however, they only log states outside the template...

CVE-2026-97591

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix handling of EBUSY in PHMAC when req is pushed to crypto engine When a request is transferred to the engine via cryptotransferhashrequesttoengine there are two return codes signaling a successful transfer:...

CVE-2026-97590

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Fix missing scrub of temp buffers with PAES algorithm In function ctrpaesdocrypt there is a buffer used to process remaining bytes AESBLOCKSIZE. This buffer was not scrubbed and thus could lead to expose of unwanted...

CVE-2026-97585

In the Linux kernel, the following vulnerability has been resolved: afs: Fix double-unmap of directory block Fix afseditdirremove to use a cleanup function to unmap the block pointed to by afsdiriter::block if it's left pointing to something rather than manually kunmapping the blocks. Manually...

CVE-2026-97584

In the Linux kernel, the following vulnerability has been resolved: afs: Fix incorrect free in candidate cleanup in afslookupserver Fix afslookupserver to not free an existing server's endpoint state when cleaning up a candidate server. The candidate record doesn't have an endpoint state yet at...

CVE-2026-97586

In the Linux kernel, the following vulnerability has been resolved: afs: Fix missing kunmap in afsdirsearchbucket Fix afsdirsearchbucket to kunmap the block it's using in the "bad:" path...

CVE-2026-97583

In the Linux kernel, the following vulnerability has been resolved: afs: Clear stale peer app data after address list changes afsfsprobefileserver fetches the current endpoint state under server-fslock, but leaves oldalist as NULL. Consequently, afssetpeerappdata treats every address list...

CVE-2026-97582

In the Linux kernel, the following vulnerability has been resolved: hwmon: gpio-fan Fix use-after-free in alarm work fanalarmirqhandler queues fandata-alarmwork, but nothing cancels it. fanalarmnotify dereferences fandata and its hwmon device. On unbind, devres frees the interrupt, which only wai...

CVE-2026-97587

In the Linux kernel, the following vulnerability has been resolved: perf: RISC-V: store available counter mask as bitmap The available-counter mask was a single unsigned long, but iteration uses RISCVMAXCOUNTERS, which is 64. On RV32 that reads past the object. Filling with an unsigned-long bit a...

CVE-2026-97588

In the Linux kernel, the following vulnerability has been resolved: s390/crypto: Map EBUSY to EIO when key conversion fails repeatedly When hardware persistently returns -EBUSY after exhausting retries, the error propagates to cryptofinalizerequest. The crypto API's completion wrapper treats -EBU...

CVE-2026-97573

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

CVE-2026-97574

In the Linux kernel, the following vulnerability has been resolved: bnxten: Don't free the live ring's TPA state on queue restart failure bnxtqueuememalloc shallow copies the live RX ring into the clone: memcpyclone, rxr, sizeofrxr; the code currently clears pointers that the clone owns such as...

CVE-2026-97575

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate AV1 tile counts The stateless AV1 decoders use tileinfo.tilecols and tilerows as loop bounds and as indices into the mistarts and insbsminus1 arrays, as the divisor for contextupdatetileid, and their...

CVE-2026-97578

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: guard VPU981 AV1 divisor and tile buffer rockchipvpu981av1decsettileinfo divides contextupdatetileid by tileinfo-tilecols and writes one descriptor per tile into the tileinfo DMA buffer, which holds...

CVE-2026-97581

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: hantro: bound G2 HEVC tile loop to the buffer capacity preparetileinfobuffer writes one entry per tile into the tilesizes DMA buffer, sized for a grid equal to the PPS uAPI array capacity. Use the bounded...

CVE-2026-97577

In the Linux kernel, the following vulnerability has been resolved: media: verisilicon: rockchip: reject AV1 frames exceeding the tile capacity rockchipvpu981av1decsettileinfo indexes the tile group entry array by tile1 tilecols + tile0, reading up to tilecols tilerows entries, lays out one...

CVE-2026-97576

In the Linux kernel, the following vulnerability has been resolved: media: v4l2-ctrls: validate HEVC tile counts The stateless HEVC decoders read numtilecolumnsminus1 + 1 entries from columnwidthminus1 and numtilerowsminus1 + 1 from rowheightminus1 and use them as tile-loop bounds, but...

CVE-2026-97579

In the Linux kernel, the following vulnerability has been resolved: media: mediatek: vcodec: bound AV1 tile-start copy to the array capacity vdecav1slicesetuptile copies tilecols + 1 / tilerows + 1 entries into micolstarts / mirowstarts from the bitstream tileinfo. Bound the copy to the array...

CVE-2026-97580

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

CVE-2026-97565

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject short READ responses in CIFSSMBRead CIFSSMBRead reads DataLengthHigh, DataLength and DataOffset out of the READRSP returned by the server without first checking that a whole READRSP was actually received. The...

CVE-2026-97568

In the Linux kernel, the following vulnerability has been resolved: mptcp: syncookies: remember the request backup flag Instead of using an uninitialised bit when copying the info in subflowulpclone. To fix this, no need to extend the joinentry structure: backup is coming from struct...

CVE-2026-97567

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous timer stop operation...

CVE-2026-97571

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...

CVE-2026-97566

In the Linux kernel, the following vulnerability has been resolved: mptcp: pm: kernel: drop pending ADDADDR when removing ID0 The in-kernel MPTCP path manager can leave a stale ADDADDR announcement entry alive when removing the id 0 endpoint. This happens because the id 0 removal path does not te...

CVE-2026-97569

In the Linux kernel, the following vulnerability has been resolved: bnxten: Prevent queue stop with deferred completions When the driver receives a burst of packets, it can mark a BD with the NOCMPL bit to defer completions. The expectation is that the last packet in the ring will have this bit...

CVE-2026-97564

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject userspace cifs.idmap descriptions cifs.idmap key descriptions carry authority-bearing fields owner and group SIDs and uid/gid values in "os:"/"gs:"/"oi:"/"gi:" form that the cifs.idmap upcall helper treats as...

CVE-2026-97570

In the Linux kernel, the following vulnerability has been resolved: bnxten: Bound SW TPA IDs to prevent crashes FW supports up to 1024 concurrent TPAs, so the FW TPA ID is in the range 0..1023 see commit ec4d8e7cf024 "bnxten: Add TPA ID mapping logic for 57500 chips.". bnxtallocaggidx is intended...

CVE-2026-97572

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate RX ring init failures in bnxtinitnic bnxtinitrxrings returns an error when bnxtalloconerxring fails, but bnxtinitnic discards that return value and calls bnxtinitchip, which enables TPA. If an allocation fails,...

CVE-2026-97562

In the Linux kernel, the following vulnerability has been resolved: smb: client: pin DFS superblock in iterator callback tconsupercb stores a raw superblock pointer, but cifsgetsuper takes its active reference only after iteratesuperstype has dropped sumount and its passive reference. Concurrent...

CVE-2026-97557

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount in cifsqueueoplockbreak cifsqueueoplockbreak unconditionally takes a reference on the target file before queueing cifsoplockbreak. Only that work item decreases the reference counter again. If...

CVE-2026-97556

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid leaking refcount when cifssbtlink fails cifsoplockbreak takes over the reference that cifsqueueoplockbreak acquired when it queued the work, and drops it with cifsFileInfoput once the break has been processed...

CVE-2026-97561

In the Linux kernel, the following vulnerability has been resolved: smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid When the administrator mounts with forceuid or forcegid uid=/gid= mount options, they expect all files to appear owned by the specified user/group. However, severa...

CVE-2026-97563

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject out-of-bounds DataOffset in CIFSSMBRead The SMB1 synchronous read helper CIFSSMBRead validates the server's DataLength against CIFSMaxBufSize and the caller's count, but never validates DataOffset. The copy...

CVE-2026-97558

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix cifsFileInfo reference leak in deferred close When cifsclose defers a close, it hands the cifsFileInfo reference of the closing struct file to the queued work. Each execution of smb2deferredworkclose drops one su...

CVE-2026-97559

In the Linux kernel, the following vulnerability has been resolved: smb: client: fail DACL rewrite when the new DACL exceeds 64K replacesidsandcopyaces and setchmoddacl accumulate the size of the DACL they build in a u16. That accumulator can wrap. validatedacl caps numaces at daclsize -...

CVE-2026-97560

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix one-byte OOB read in smb2parsenativesymlink When parsing a share-root relative native symlink, memcpy copies smbtarget+1 skipping the leading separator but uses strlensmbtarget+1 as the length, reading one byte...

CVE-2026-97554

In the Linux kernel, the following vulnerability has been resolved: smb: client: avoid using uninitialized SIDs in cifsposixtofattr cifsposixtofattr ignores the return value of posixinfoparse. When a malformed POSIX directory entry is encountered e.g. invalid SID lengths from an untrusted server,...

CVE-2026-97553

In the Linux kernel, the following vulnerability has been resolved: xfs: lock the healthmon when inserting unmount event LOLLM complains that xfshealthmonunmount does an unlocked insert of the unmount event into the health monitor's event list. Fix that...

CVE-2026-97547

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchange-range reflink flag clearing issue with INO1WRITTEN When exchanging two full-file ranges, xmicanexchangereflinkflags can move the reflink inode flag from the file that currently has it to the other file, as long ...

CVE-2026-97548

In the Linux kernel, the following vulnerability has been resolved: xfs: fix the rtrmap and rtrefcount maxlevelsondisk functions The maxlevelsondisk functions are used to compute the size of in-memory btree cursors for each btree type. Unfortunately, LOLLM noticed that the rtrmap and rtrefcount...

CVE-2026-97550

In the Linux kernel, the following vulnerability has been resolved: xfs: fix unit conversions in perbinval computation LOLLM noticed that we're doing the unit conversion in the perbinval computation backwards -- xfsbufinvallogspace's second parameter is supposed to be in bytes, but maxbinval is i...

CVE-2026-97549

In the Linux kernel, the following vulnerability has been resolved: xfs: fix under-reservation of blocks when repairing sf directories Whilst running QA on XFS for-next as of 7.3-rc2 with MKFSOPTIONS="-n size=8192", I observed the following trimmed dmesg splat: XFS: Assertion failed: args-total =...

CVE-2026-97551

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise args-total for parent pointer updates xfsparentdaargsinit builds an xfsdaargs from a zeroed xfsparentargs kmemcachezalloc, leaving args-total == 0. xfsdagrowinodeint treats that field as a running block reservatio...

CVE-2026-97552

In the Linux kernel, the following vulnerability has been resolved: xfs: initialise error in xfsdeferfinishone xfsdeferfinishone declares error without an initialiser and only assigns it inside the loop over dfp-dfpwork. When that list is empty the loop body never runs, control falls through to t...

CVE-2026-97555

In the Linux kernel, the following vulnerability has been resolved: smb: client: fix heap overflow in DACL owner/group rewrite When idmodetocifsacl rewrites an existing DACL, it allocates a buffer sized according to the on-disk DACL length reported by daclptr-size. However, replacesidsandcopyaces...

CVE-2026-97541

In the Linux kernel, the following vulnerability has been resolved: wifi: ath9khtc: don't store usbdeviceid usbdeviceid is not guaranteed to live longer than probe due to presence of dynamic ID. All information apart from driverdata can be easily retrieved from usbdevice, so just store driverdata...

CVE-2026-97543

In the Linux kernel, the following vulnerability has been resolved: xfs: destroy seen inode bitmap when we fail to add a dirpath LOLLM observes a memory leak in xchkdirtreecreatepath if we create the directory path object but appending the name to the path fails. When this happens, we don't tear...

CVE-2026-97545

In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak newbp if xfsbtreebloaddropbuf fails LOLLM observes that in xfsbtreebloadprepblock, xfsbtreebloaddropbuf can hit an IO error if writing the delwri buffer list to disk fails. In this case, we fail to release newbp,...

CVE-2026-97540

In the Linux kernel, the following vulnerability has been resolved: net: usb: pegasus: don't rely on id table pointer arithmetic The current code is broken when dynamic ID is involved; in such cases usbdeviceid parameter of probe lives on the heap and the pointer arithmetic will get an index that...

CVE-2026-97544

In the Linux kernel, the following vulnerability has been resolved: xfs: don't leak dqacct if rhashtable insertion fails LOLLM observes that xqcheckmodliveinodqtrx doesn't free the newly allocated dqa object if rhashtable insertion fails. Fix this leak...