CVE-2026-98501

In the Linux kernel, the following vulnerability has been resolved: HID: alps: fix use-after-free on input2 registration failure alpsinputconfigured stores data-input2 before calling inputregisterdevice. If registration fails, inputfreedevice frees the input device but data-input2 still points to...

CVE-2026-98506

In the Linux kernel, the following vulnerability has been resolved: mm/hugetlb: do not dissolve gigantic pages without runtime support dissolvefreehugetlbfolio doesn't check hstateisgiganticnoruntimeh though removehugetlbfolio/ updateandfreehugetlbfolio silently bail for such folios, so it frees ...

CVE-2026-98505

In the Linux kernel, the following vulnerability has been resolved: mm/damon/vaddr: avoid hw-driven pte updates during damonhugetlbmkold damonhugetlbmkold reads the page table entry into a local variable, unsets the accessed bit in the variable, and updates the page table entry with the updated...

CVE-2026-98500

In the Linux kernel, the following vulnerability has been resolved: HID: hid-oxp: use canceldelayedworksync in remove oxphidremove uses canceldelayedwork for all three delayed work items. canceldelayedwork only dequeues a pending work item without waiting for a currently executing callback to...

CVE-2026-98508

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: fix NULL pointer dereference on fence allocation failure virtiogpufencealloc can fail due to memory pressure and return NULL, but its caller like virtiogpuinitsubmit never checks it. Later, virtiogpuinitsubmit passes...

CVE-2026-98493

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

CVE-2026-98494

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98492

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

CVE-2026-98495

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

CVE-2026-98497

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...

CVE-2026-98498

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix reventry reference leak in mlx5tcctsharedcounterget When the reverse entry is found but its counter is already being released, refcountincnotzero fails and the reference taken by mlx5tcctentryget is never dropped...

CVE-2026-98499

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: fix OOB read in wacomwacpenserialenforce The 'wacomwacpenserialenforce' function may calculate and pass an invalid offset to hidfieldextract, resulting in memory reads at incorrect addresses -- possibly beyond the end...

CVE-2026-98496

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98491

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98484

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip expired catchall elements on insert and delete nftsetelemcatchallinsert looks up duplicates with nftsetelemactive only, while nftsetcatchalllookup and the dump path additionally skip expired elements. On...

CVE-2026-98488

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98487

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98485

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98490

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98489

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98486

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

CVE-2026-98483

In the Linux kernel, the following vulnerability has been resolved: nfc: fix use-after-free in nfcgetlocalgeneralbytes Commit 6709d4b7bc2e "net: nfc: Fix use-after-free caused by nfcllcpfindlocal" attempted to fix a use-after-free UAF issue by invoking nfcllcplocalputlocal after accessing local-g...

CVE-2026-98479

In the Linux kernel, the following vulnerability has been resolved: scsi: libiscsitcp: Check the data direction of a Data-In PDU The Data-In branch of iscsitcphdrdissect resolves the ITT to a task and copies the PDU's data segment into that command's scatterlist without asking whether the command...

CVE-2026-98482

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: drop truncated I/RR/RNR PDUs in nfcllcprecvhdlc nfcllcprecvhdlc reads the sequence byte skb-data2, via nfcllcpns/nfcllcpnr, before any length check. The receive path only guarantees the two-byte LLCP header --...

CVE-2026-98476

In the Linux kernel, the following vulnerability has been resolved: s390/cio: Fix NULL pointer dereference in ccwdevicegetutilstr The channel path registry entry associated with a CHPID may be removed while the subchannel's PMCW still references that CHPID. In this case, chpidtochp can return NUL...

CVE-2026-98477

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix NULL pmuctx passed to pmu-schedtask perfpmuschedtask returns early when cpuctx-taskctx is set, and cpc-taskepc is only non-NULL while a task context is scheduled in on this CPU. perfpmuschedtask therefore always...

CVE-2026-98475

In the Linux kernel, the following vulnerability has been resolved: s390/cmf: Fix virtual vs physical address confusion The measurement block address is an absolute address. Define the associated schibconfig and schib fields as dma64t to enable automatic detection of incorrect assignments. Also a...

CVE-2026-98478

In the Linux kernel, the following vulnerability has been resolved: scsi: ufs: core: Keep internal commands dispatchable during error handling Commit 08b12cda6c44 "scsi: ufs: core: Switch to scsigetinternalcmd" switched UFS internal commands to allocate requests on hba-host-pseudosdev-requestqueu...

CVE-2026-98481

In the Linux kernel, the following vulnerability has been resolved: nfc: port100: reject frames whose declared length exceeds the received data port100recvresponse passes the URB transfer buffer to port100rxframeisvalid, which checksums le16tocpuframe-datalen bytes of frame-data. datalen is a...

CVE-2026-98480

In the Linux kernel, the following vulnerability has been resolved: nfc: trf7970a: power down on startup RX gain failure trf7970astartup powers up the device before applying the optional RX gain reduction. If the register read or write fails, it returns without undoing that power-up. Probe's unwi...

CVE-2026-98469

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix AArch32 DBGBXVR handling The consolidation of the breakpoint and watchpoint register accessors switched DBGBXVR from trapbvr to trapdbgwbreg. The latter selects backing storage with demuxwbreg, which only handles...

CVE-2026-98471

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Do cache maintenance on the source VM during intra-host migration Manually perform cache maintenance on the source VM during intra-host migration to ensure no stale data is left in CPU caches after the VM is destroyed...

CVE-2026-98467

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race Commit 7270cc9157f4 "KVM: arm64: nv: Handle VNCREL2 invalidation from MMU notifiers" introduced VNCREL2 invalidation in both kvmnesteds2unmap and kvmnesteds2wp...

CVE-2026-98468

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Fix spurious warning for benign stage 2 teardown race kvmtool was used to establish an L1 guest with 8 CPUs and 8 GiB of RAM, an L2 guest with 4 CPUs and 4 GiB of RAM and an L3 guest with 2 CPUs and 2 GiB of RAM, all ...

CVE-2026-98470

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't WARN on an unknown VM ioctl in protected mode kvmpkvmioctlallowed WARNs when kvmgetcapforkvmioctl doesn't find the ioctl number in vmioctlcaps, and kvmarchvmioctl calls it for every number the generic code doesn...

CVE-2026-98466

In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 fixhostownership walks only the linear-map alias of each memblock region, and the per-CPU hyp stack, mapped in the private VA range for its guard page, has none. Wa...

CVE-2026-98473

In the Linux kernel, the following vulnerability has been resolved: s390/vfio-ap: fix KVM GISC and page leak when queue removed from host config Three related problems exist in the handling of KVM interrupt and page resources when a queue is removed from the host's AP configuration while assigned...

CVE-2026-98474

In the Linux kernel, the following vulnerability has been resolved: s390/pci: Fix missing device lock in zpcireportstatus When pdev is non-NULL, zpcireportstatus accesses the device's driver. To get a consistent state matching the recovery, the device lock needs to be held. Do so by expanding the...

CVE-2026-98472

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Free haveruncpus during VM destruction even if VM is no longer SEV Unconditionally free SEV's "have run CPUs" cpumask in the VM destroy path, i.e. even for what appear to be non-SEV VMs, as an SEV VM becomes a non-SEV V...

CVE-2026-98460

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: reject out-of-range OCF values The raw HCI socket security filter has 128 OCF bits per supported OGF, but masks the 10-bit OCF with 127 before looking up the command. An unprivileged socket can therefore submi...

CVE-2026-98456

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: mgmt: fix race in readunconfindexlist readunconfindexlist counts unconfigured controllers before allocating its response, then checks the device flags again while filling it. hcidevlistlock stabilizes list membership,...

CVE-2026-98463

In the Linux kernel, the following vulnerability has been resolved: schedext: Derive SCXRQINWAKEUP from the core enqueue flags scheduledeferredlocked skips scheduling a deferred action while SCXRQINWAKEUP is set and relies on the taskwokenscx call that follows a wakeup enqueue to run it...

CVE-2026-98458

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: release unused CIS holds after channel attach hcibindcis and hciconnectcis return one hciconn hold for the ISO layer. A new channel association consumes that hold, which is eventually released by isoconnfree. Ther...

CVE-2026-98461

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: validate event length before filtering isfilteredpacket reads the event code from skb-data0 without first checking that the skb is nonempty. When an opcode filter is configured, it also reads the command opcod...

CVE-2026-98457

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: validate frame length before control and FCS access l2capdatarcv unpacks either a two-byte or four-byte control field without first ensuring that it is present. A short ERTM or streaming-mode frame can therefore...

CVE-2026-98459

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: balance the parent hold in hcibindbis hciconnlink takes a lifetime reference to its parent with hciconnget, but only takes an operational hold on the child. hciconnunlink later balances both a hold and a reference...

CVE-2026-98465

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Serialize IMSIC attributes with vCPU migration KVM device ioctls are not serialized against KVMRUN. As a result, kvmriscvaiaimsicrwattr can snapshot the physical CPU and HGEI of an IMSIC VS-file before a concurrent...

CVE-2026-98462

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciconn: fix CIS hold ownership on reuse Commit 69997d50ec57 "Bluetooth: ISO: handle bound CIS cleanup via hciconn" made hcibindcis and hciconnectcis return a connection with one hold for the ISO layer. hcibindcis...

CVE-2026-98464

In the Linux kernel, the following vulnerability has been resolved: RISC-V: KVM: Synchronize hrtimer callback during teardown The non-Sstc hrtimer callback clears nextset before its final uses of the enclosing vCPU. If teardown observes nextset as false while the callback is still running,...

CVE-2026-98451

In the Linux kernel, the following vulnerability has been resolved: smb: client: use finishnoopen for non-regular inodes An OCREAT open can find an existing symlink or another non-regular inode. cifsatomicopen calls finishopen on it and attaches a cifsFileInfo. Symlink inodes have no CIFS release...