CVE-2026-98792

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98794

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98797

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98799

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

CVE-2026-98783

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Add missing ISERR check for ovladaptor platform device platformdeviceregisterdata can fail and return an ERRPTR, but the return value is used without checking, leading to an invalid pointer being stored in ddpcomp.d...

CVE-2026-98785

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98790

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98782

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix ovl adaptor platform device leak mtkdrmprobe creates an OVL adaptor platform device with platformdeviceregisterdata when the display pipeline requires the OVL adaptor. If a later initialization step fails, the...

CVE-2026-98788

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98781

In the Linux kernel, the following vulnerability has been resolved: drm/mediatek: Fix pdev reference leak in mtkdrmbind When the device is not the mmsys master, mtkdrmbind returns early after taking a reference on the disp-mutex device via offinddevicebynode, without ever dropping it: mtkdrmunbin...

CVE-2026-98784

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/gfx6: fix firmware leak on teardown The firmware requested in gfxv60initmicrocode is not released when the GFX block is torn down, leaking the firmware resources. Add gfxv60freemicrocode and call it from gfxv60swfini t...

CVE-2026-98786

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98787

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...

CVE-2026-98789

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98771

In the Linux kernel, the following vulnerability has been resolved: usb: storage: sierrams: reject short SWoC info transfers sierragetswocinfo requests sizeofstruct swocinfo 60 bytes from the device via usbcontrolmsg, but its callers only treat a negative return value as failure. A device that...

CVE-2026-98778

In the Linux kernel, the following vulnerability has been resolved: binder: fix isfailure flag for superseded transaction cleanup When a TFUPDATETXN transaction supersedes a pending async transaction, binderreleaseentirebuffer is called with isfailure=false. Since the superseded transaction was...

CVE-2026-98779

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix ACP MFD device leak on init failure acphwinit registers ACP child devices with mfdadddevices before attaching them to the ACP power domain and initializing the hardware. If attaching a child to the power domain...

CVE-2026-98772

In the Linux kernel, the following vulnerability has been resolved: USB: serial: fix port tear down use-after-free Some drivers for multiport devices access port driver data from completion handlers of shared URBs submitted at attach or first open and stopped at disconnect or last close,...

CVE-2026-98773

In the Linux kernel, the following vulnerability has been resolved: USB: cdc-acm: skip URB restart in portshutdown if disconnected acmportshutdown is called from the tty-port machinery whenever the last user closes the port. acmdisconnect sets acm-disconnected and calls ttyportttyvhangup, which...

CVE-2026-98775

In the Linux kernel, the following vulnerability has been resolved: nitroenclaves: fix use-after-free on SLOTALLOC failure When necreatevmioctl fails the SLOTALLOC request after anoninodegetfile has succeeded, the error path calls fputenclavefile and then frees neenclave. In normal userspace...

CVE-2026-98776

In the Linux kernel, the following vulnerability has been resolved: binderfs: fix UAF write in binderadddevice binderfsbinderdevicecreate publishes the new dentry with dmakepersistent and then calls simpledonecreating, which drops the parent directory lock and the creator's dentry reference. It...

CVE-2026-98774

In the Linux kernel, the following vulnerability has been resolved: rustbinder: cancel deferred work items in thread exit If there are deferred work items on the thread todo list, then they are not cleaned up in the Thread::release method. Thus, update the code to clean up the work items even if...

CVE-2026-98777

In the Linux kernel, the following vulnerability has been resolved: binder: fix leaked fd fixups on TFUPDATETXN supersede When a TFUPDATETXN transaction supersedes a pending async transaction in a frozen process, the outdated transaction is freed with kfree directly. This skips binderfreetxnfixup...

CVE-2026-98780

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: fix IP instance memory leak on kobject add failure amdgpudiscoverysysfsips allocates iphwinstance with kzallocflex and initializes its embedded kobject before calling kobjectadd. If kobjectadd fails, the return value ...

CVE-2026-98762

In the Linux kernel, the following vulnerability has been resolved: USB: dwc2: shut down wakeup timer before freeing HCD state dwc2wakeupdetected accesses the DWC2 host state and can rearm the wakeup timer. dwc2hcdfree currently deletes the timer only after freeing host-owned state, and timerdele...

CVE-2026-98764

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: ffs: Fix NULL pointer dereference in FUNCTIONFSENDPOINTDESC When user space sets up FunctionFS with only full-speed descriptors e.g., flags = FUNCTIONFSHASFSDESC and the gadget operates at a higher speed such as...

CVE-2026-98765

In the Linux kernel, the following vulnerability has been resolved: USB: gadget: dummy-hcd: Fix wait for outstanding request completions The dummy-hcd driver emulates synchronizeirq by waiting until its private callbackusage counter drops to 0 with the private lock not held. This counter is...

CVE-2026-98766

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: aspeed-vhub: cancel wake work on device removal wakework is armed from the gadget .wakeup callback to resume suspended downstream ports, and it is never cancelled in astvhubremove, so a work item queued before or...

CVE-2026-98763

In the Linux kernel, the following vulnerability has been resolved: usb: core: clear both epin and epout for non-ep0 control endpoints In usbenableendpoint, non-zero control endpoints where usbendpointxfercontrol&ep-desc is true populate both dev-epinepnum and dev-epoutepnum with the same struct...

CVE-2026-98767

In the Linux kernel, the following vulnerability has been resolved: usb: dwc3: gadget: fix IRQ storm on invalid event buffer count When dwc3checkeventbuf reads a GEVNTCOUNT value exceeding the event buffer length, commit 63ccd26cd1f6 "usb: dwc3: gadget: check that event count does not exceed even...

CVE-2026-98768

In the Linux kernel, the following vulnerability has been resolved: usb: typec: anx7411 - stop the IRQ before destroying the workqueue The IRQ is devm-managed, so it can still queue plat-work while remove is tearing the queue down. Disable it first...

CVE-2026-98769

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: fuac1legacy: validate bRequest index in genericset,getcmd genericsetcmd and genericgetcmd use the low nibble of ctrl-bRequest as an index into con-data: u8 cmd = ctrl-bRequest & 0x0F; / 0 .. 15 / ... con-datacmd =...

CVE-2026-98770

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: midi2: Fix the jack descriptor array sizes The jack in/out descriptor arrays in struct fmidi2usbconfig have the size of MAXCABLES, which look reasonable -- but it turned out to be incorrect. Namely, the entries for...

CVE-2026-98753

In the Linux kernel, the following vulnerability has been resolved: tty: ttyport: restore TTYIOERROR on activation failure Make sure to restore the TTYIOERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic...

CVE-2026-98755

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: zero-initialize control packet in vccsendctl The stack-allocated struct viovcc pkt was partially initialized, leaving the tag.stypeenv field uninitialized before being sent via ldcwrite, potentially leaking kernel stack...

CVE-2026-98757

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: fix use-after-free in cdns3gadgetexit cdns3gadgetstart arms two works on systemfreezablewq: pendingstatuswq for the deferred ep0 status stage and alignedbufwq for realigned request buffers. Both handlers use the...

CVE-2026-98759

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in cd321xupdatework cd321xupdatework passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartn...

CVE-2026-98756

In the Linux kernel, the following vulnerability has been resolved: usb: cdns3: Fix NULL pointer dereference in cdns3pciprobe The Cadence USBSS controller is a two-function PCI device. The first probed function allocates the driver data and stores it with pcisetdrvdata, while the second function...

CVE-2026-98758

In the Linux kernel, the following vulnerability has been resolved: usb: typec: ucsi: glink: fix use-after-free of ucsi on remove The pmicglink client is released by the devres cleanup, which runs after pmicglinkucsiremove has returned, so its notification callbacks can queue work until then. Wor...

CVE-2026-98760

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tipd: fix uninitialized typecpartnerdesc in tps6598xconnect tps6598xconnect passes a stack-allocated typecpartnerdesc to typecregisterpartner after initializing only usbpd, accessory and identity. typecregisterpartner...

CVE-2026-98754

In the Linux kernel, the following vulnerability has been resolved: tty: vcc: hold port lock when clearing tty pointer in vcccleanup vcccleanup sets port-tty to NULL without holding port-lock, racing with vccevent LDC callbacks that read port-tty under port-lock and then use tty-port. This can...

CVE-2026-98761

In the Linux kernel, the following vulnerability has been resolved: usb: typec: tcpm: recover after failure to start the frs ams Reset the port if the tcpm fails to start the FASTROLESWAP AMS by initiating error recovery on it. This helps in cases where some cables incorrectly signal an FRS to an...

CVE-2026-98747

In the Linux kernel, the following vulnerability has been resolved: serial: core: fix NULL pointer dereference in serialcoreunregisterport port-portdev is NULL when no port device is installed: it is cleared on teardown, and never set if registration failed before serialcoreportdeviceadd...

CVE-2026-98750

In the Linux kernel, the following vulnerability has been resolved: tty: fix saved termios reset race Resetting saved termios state on device registration is needed where a minor number can be reused for an entirely different device and where the old settings may prevent the port from even being...

CVE-2026-98752

In the Linux kernel, the following vulnerability has been resolved: tty: port: fix ttyportttyvhangup race Drivers rely on ttyportttyvhangup to synchronously hang up their ports before tearing down resources as part of deregistration e.g. on physical disconnect. If ttyportttyvhangup races with...

CVE-2026-98743

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: rt1017-sdca-sdw: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98744

In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: max98363: fix uninitialized streamconfig-type streamconfig is not initialized before being passed to sdwstreamaddslave. The type field may contain garbage and is later copied to stream-type by sdwconfigstream...

CVE-2026-98746

In the Linux kernel, the following vulnerability has been resolved: serial: ma35d1: Fix clock reference leak in ma35d1serialprobe ofclkget returns a clock with a reference that has to be released with clkput. ma35d1serialprobe never does that, so the reference is leaked on the probe error paths a...

CVE-2026-98748

In the Linux kernel, the following vulnerability has been resolved: serial: 8250bcm7271: fix use-after-free in brcmuartremove brcmuarthandleirq starts priv-hrt to work around a receive-timeout quirk of the 8250 core when hardware flow control is enabled; the timer callback brcmuarthrtimerfunc...

CVE-2026-98745

In the Linux kernel, the following vulnerability has been resolved: arm64/fpsimd: signal: Forbid non-streaming SVE payload on SME-only systems When systemsupportssme is true but systemsupportssve is false, restoring a specifically crafted SVE signal context can result in the task erroneously havi...