CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97951 scsi: target: iscsi: Fix hang for aborted WRITE_PENDING commands

In the Linux kernel, the following vulnerability has been resolved: scsi: target: iscsi: Fix hang for aborted WRITEPENDING commands When a LUNRESET aborts a WRITE command that is in the TRANSPORTWRITEPENDING state, the target core sets CMDTABORTED and waits for the frontend to finish processing. ...

CVE-2026-97949 configfs: unhash the dentry before dropping the item in rmdir

In the Linux kernel, the following vulnerability has been resolved: configfs: unhash the dentry before dropping the item in rmdir configfsgetconfigitem treats a hashed dentry as proof that sd-selement is a live configitem. configfsrmdir breaks that: simplermdir leaves the dentry hashed, the last...

CVE-2026-97950 configfs: pin the symlink target's dirent instead of chasing ->ci_dentry

In the Linux kernel, the following vulnerability has been resolved: configfs: pin the symlink target's dirent instead of chasing -cidentry createlink reads the target's configfsdirent from item-cidentry-dfsdata, relying on the item reference taken by gettarget. That reference pins the item, not i...

CVE-2026-97948 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

CVE-2026-97947 x86/amd_node: Fix potential NULL pointer dereference

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix potential NULL pointer dereference amdsmnread/write are exported functions around amdsmnrw, so they are always available even if amdsmninit fails. In that case, 'amdroots' is NULL and amdsmnrw will access...

CVE-2026-97946 x86/amd_node: Fix PCI device reference counting in amd_smn_init()

In the Linux kernel, the following vulnerability has been resolved: x86/amdnode: Fix PCI device reference counting in amdsmninit The local "root" pointer is a temporary variable used during the device search. Therefore, refcount related to the search iterators should be cleaned up after the searc...

CVE-2026-97944 x86/cfi: Fix FineIBT hash offset in cfi_get_func_hash()

In the Linux kernel, the following vulnerability has been resolved: x86/cfi: Fix FineIBT hash offset in cfigetfunchash The switch of the FineIBT preamble from "subl $hash, %r10d" to the shorter "subl $hash, %eax" moved the hash immediate from offset 7 to offset 5 of the preamble...

CVE-2026-97945 x86/mm: Fix user-space data loss with MADV_FREE and THP

In the Linux kernel, the following vulnerability has been resolved: x86/mm: Fix user-space data loss with MADVFREE and THP Some of users of Polars a data analytics library have lost production data from this bug. They seem to have just the right combination of huge pages, MADVFREE and heavy recla...

CVE-2026-97942 x86/alternatives: Exclude text poking against change_page_attr()

In the Linux kernel, the following vulnerability has been resolved: x86/alternatives: Exclude text poking against changepageattr From time to time, the following BUG can be observed in the x86 alternatives patching code 0: kernel BUG at arch/x86/kernel/alternative.c:2576! Oops: invalid opcode: 00...

CVE-2026-97943 x86/mm/pat: Acquire init_mm write lock on collapse to avoid UAF

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

CVE-2026-97941 mm/slab: take n->list_lock in __slab_try_return_freelist() to avoid race

In the Linux kernel, the following vulnerability has been resolved: mm/slab: take n-listlock in slabtryreturnfreelist to avoid race Commit ba7425312607 "mm, slab: add an optimistic slabtryreturnfreelist" incorrectly assumed that nobody has freed an object to the slab as long as slab-freelist is...

CVE-2026-97939 ipmr: account multicast table and route memory

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

CVE-2026-97940 ipv6: fix fib6 walker UAF on seq stop

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...

CVE-2026-97937 ftrace: fork: Initialize function graph state before copy_exec_state()

In the Linux kernel, the following vulnerability has been resolved: ftrace: fork: Initialize function graph state before copyexecstate duptaskstruct copies the parent's taskstruct, including retstack. ftracegraphinittask clears the copied function graph state, but it currently runs after...

CVE-2026-97938 reboot: fix cad_pid use-after-free race

In the Linux kernel, the following vulnerability has been resolved: reboot: fix cadpid use-after-free race cadpid is a single kernel-wide struct pid pointer. procdocadpid reads it and passes it to pidvnr without protecting the lifetime of the referenced struct pid. A concurrent writer can replace...

CVE-2026-97936 tracing: Fix memory corruption from the histogram stacktrace modifier

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from the histogram stacktrace modifier parsefield sets HISTFIELDFLSTACKTRACE from the ".stacktrace" modifier before it looks the field name up, and nothing afterwards checks that the name resolved t...

CVE-2026-97935 tracing: Set the trace clock before registering the histogram trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Set the trace clock before registering the histogram trigger histregistertrigger puts the trigger on the global namedtriggers list in cmdops-init, and only then sets the trace clock: if data-cmdops-init ret =...

CVE-2026-97934 tracing: Fix memory corruption from a "STACKTRACE" histogram key

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix memory corruption from a "STACKTRACE" histogram key "cpu", "CPU", "stacktrace" and "STACKTRACE" are generic fields, defined with an offset and a size of zero so that the filter code can match them by name. parsefield...

CVE-2026-97933 tracing: Take trace_array reference when opening a tracer options file

In the Linux kernel, the following vulnerability has been resolved: tracing: Take tracearray reference when opening a tracer options file When a tracer option file is opened, it is passed a descriptor that points to an element on the tracearray's topts array. This element has information to find...

CVE-2026-97932 tracing: Don't dereference trace_event_file in deferred trigger free

In the Linux kernel, the following vulnerability has been resolved: tracing: Don't dereference traceeventfile in deferred trigger free The enableevent trigger defers traceeventputref to the trigger free kthread, but the traceeventfile can already be freed when the instance is removed. Keep the...

CVE-2026-97931 ALSA: us122l: Prevent write upgrades for read mappings

In the Linux kernel, the following vulnerability has been resolved: ALSA: us122l: Prevent write upgrades for read mappings The hwdep mmap callback rejects read-buffer mappings that are initially writable, but leaves VMMAYWRITE set on mappings created with PROTREAD. A process that can open the hwd...

CVE-2026-97930 ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: fix in04last array size mismatch with in04buf The in04last array in struct usx2ydev is declared as char24, but in04buf is allocated as sizeofstruct us428ctls which is 21 bytes. In iusx2yin04int, when ctlsnapshotla...

CVE-2026-97929 ALSA: usbusx2y: validate URB actual_length in interrupt callback

In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actuallength in interrupt callback iusx2yin04int processes the interrupt URB data without checking urb-actuallength. A short transfer from a malfunctioning device would cause the handler to process...

CVE-2026-97928 drm/amdgpu: skip the VMID 0 flush for VRAM

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdgputtmmapbuffer reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 e.g...

CVE-2026-97927 ufs: create the root dentry after loading cylinder metadata

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufsfillsuper installed sb-sroot before it loaded the cylinder group structures for a writable mount: sb-sroot = dmakerootinode; ... if !sbrdonlysb if...

CVE-2026-97926 ufs: validate cylinder group metadata before caching it

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufsreadcylinder copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi-ccgx = fs32tocpusb, ucg-cgcgx...

CVE-2026-97925 tick/broadcast: Plug clockevents replacement race

In the Linux kernel, the following vulnerability has been resolved: tick/broadcast: Plug clockevents replacement race 朱恺乾 reported and decoded the following race condition when a broadcast device is replaced: CPUA CPUB tickbroadcastoneshotcontrol bc = tickbroadcastdevice.evtdev;...

CVE-2026-97923 tracing: Free histogram the var ref when its initialization fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the var ref when its initialization fails createvarref allocates a VARREF histfield and then calls initvarref to fill it in. When that fails the field is leaked. commit 656fe2ba85e8 "tracing: Use hist...

CVE-2026-97924 tracing/user_events: Don't destroy fields when event removal fails

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Don't destroy fields when event removal fails destroyuserevent destroys the event's fields before attempting to remove the trace event call. If usereventsetcallvisible fails, e.g. because the event is still...

CVE-2026-97922 tracing: Free histogram var refs regardless of how often they are referenced

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram var refs regardless of how often they are referenced Using the same variable three or more times in one hist trigger leaks the variable reference and its strings when the trigger is removed. commit...

CVE-2026-97921 tracing: Free histogram the field rejected for a bad modifier

In the Linux kernel, the following vulnerability has been resolved: tracing: Free histogram the field rejected for a bad modifier Writing a hist trigger whose value or variable carries a modifier that is not allowed there leaks the fields that were built for it. createvalfield takes the field fro...

CVE-2026-97920 tracing: Keep the entry count when the histogram stats allocation fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

CVE-2026-97919 tracing: Take the reference before publishing the named histogram trigger

In the Linux kernel, the following vulnerability has been resolved: tracing: Take the reference before publishing the named histogram trigger eventhisttriggernamedinit puts the trigger on the global namedtriggers list and only then takes the reference on the trigger it shares its histogram with:...

CVE-2026-97918 tracing: Undo the registration when enabling the histogram trigger fails

In the Linux kernel, the following vulnerability has been resolved: tracing: Undo the registration when enabling the histogram trigger fails Commit 6f86bdeab633 "tracing: Fix bad hist from corrupting namedtriggers list" described how a trigger that is registered but not on file-triggers ends up...

CVE-2026-97917 accel/ivpu: Validate full buffer range in ivpu_to_cpu_addr

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate full buffer range in ivputocpuaddr Add a size parameter to ivputocpuaddr and validate that the whole vpuaddr, vpuaddr + size range stays within the BO...

CVE-2026-97916 accel/ivpu: Validate firmware log buffer metadata

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Validate firmware log buffer metadata The tracing log headers parsed by fwlogprintbuffer reside in DMA-shared BOs that the NPU firmware can write to. fwlogfrombo validated log-headersize and log-size, but...

CVE-2026-97915 accel/ivpu: Limit firmware log name prints to field size

In the Linux kernel, the following vulnerability has been resolved: accel/ivpu: Limit firmware log name prints to field size The name in struct vputracingbufferheader is a fixed-size array populated by the NPU firmware. It is expected to be NUL-terminated, but nothing on the host side enforces...

CVE-2026-97914 accel: ethosu: Fix ethosu_job_open() return value

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Fix ethosujobopen return value A WARNON returns a 0 or 1, not the original negative errno. Just drop the WARNON as the FD open will pass the return code to userspace and there's only one possible source of the erro...

CVE-2026-97913 accel: ethosu: Ensure cmd stream ends with a stop op

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure cmd stream ends with a stop op While the QSIZE register setting should prevent an out of bounds access of the command stream, it is not clear whether the h/w generates an interrupt in this case as is require...

CVE-2026-97912 accel: ethosu: Ensure SRAM size is 0 on mapping failure

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM size is 0 on mapping failure On a mapping failure of the SRAM, the SRAM size is left as non-zero. The probe will succeed as the error return is not checked since having SRAM is not a hard requirement. T...

CVE-2026-97911 accel: ethosu: Ensure SRAM region size matches job

In the Linux kernel, the following vulnerability has been resolved: accel: ethosu: Ensure SRAM region size matches job It is possible for userspace to set the job SRAM size to 0, but then still have SRAM accesses in the command stream. When the job SRAM size is 0, setting the region base register...

CVE-2026-97910 ASoC: sprd: validate compress buffer sizes against fixed allocations

In the Linux kernel, the following vulnerability has been resolved: ASoC: sprd: validate compress buffer sizes against fixed allocations sprdplatformcompropen allocates the stage 0 IRAM buffer 32K data area and the stage 1 DDR buffer 2M data area with fixed sizes, but sprdplatformcomprcopy derive...

CVE-2026-97909 ASoC: sti: initialize IRQ lock before requesting IRQ

In the Linux kernel, the following vulnerability has been resolved: ASoC: sti: initialize IRQ lock before requesting IRQ unireaderinit registers the shared IRQ before initializing reader-irqlock. A pending interrupt can invoke the handler while the lock is still uninitialized. Initialize the lock...

CVE-2026-97907 Bluetooth: btrtl: Don't leak return code when parsing firmware format v2

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btrtl: Don't leak return code when parsing firmware format v2 When keyid from chip is zero, rtlbtparsefirmwarev2 intentionally ignores all security headers. However, the implementation simply breaks from a switch...

CVE-2026-97908 Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hcidev The command and ACL RPMsg endpoints store struct btqcomsmd as their callback private data. The receive callbacks dereference btq-hdev without taking an hcidev...

CVE-2026-97905 cpufreq: zero-initialize policy cpumask before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: zero-initialize policy cpumask before sysfs publication cpufreqpolicyalloc allocates policy-cpus with alloccpumaskvar, i.e. without GFPZERO, unlike the sibling relatedcpus and realcpus masks. With CONFIGCPUMASKOFFSTACK=y...

CVE-2026-97906 bootconfig: Fix integer overflow in initrd size check

In the Linux kernel, the following vulnerability has been resolved: bootconfig: Fix integer overflow in initrd size check Sashiko reported that in getbootconfigfrominitrd, a crafted initrd with a huge bootconfig size such as 0xFFFFFFFF can cause the pointer arithmetic: data = void hdr - size; to...

CVE-2026-97904 cpufreq: initialize policy rwsem before sysfs publication

In the Linux kernel, the following vulnerability has been resolved: cpufreq: initialize policy rwsem before sysfs publication cpufreqpolicyalloc initializes policy-rwsem after kobjectinitandadd has created the policy sysfs directory and its default attributes. A sysfs access can therefore reach a...

CVE-2026-97902 fs: don't return -EINVAL for successful nested thaw

In the Linux kernel, the following vulnerability has been resolved: fs: don't return -EINVAL for successful nested thaw Commit 7366f8b6fc6a "fs: handle freezing from multiple devices" replaced the freezeholders bitmask with per-holder counters to allow nested freezes. In the bitmask version, a th...