CVE-2026-98062

A flaw in the Linux kernel's BPF subsystem allows a local user with privileges to attach BPF programs to exploit a memory handling issue. The kernel incorrectly treats siginfo arguments in the signal_generate and signal_deliver tracepoints as trusted memory pointers. However, these tracepoints ca...

CVE-2026-98078

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization hton_seq() expects the host-order source first and the unalignednetwork-order destination second. The version 1 sync sender passes thesearguments in reverse for both sequence block...

CVE-2026-98132

A flaw exists in the Linux kernel 's Berkeley Packet Filter (BPF) verifier, specifically within the states.c:__clean_func_state() function. The vulnerability occurs when the verifier incorrectly downgrades a half-dead scalar zero spill to STACK_ZERO because a portion of the stack memory is consid...

CVE-2026-100074

The Linux kernel contains a vulnerability where the BPF_REFCOUNT field is not marked as a unique field , which is an oversight that has been addressed in recent updates. This issue affects the bpf subsystem. While the documents confirm the fix and identify the specific component, no information r...

CVE-2026-98138

A flaw exists in the Linux kernel's NTFS file system driver where the ntfs_sync_fs() function unconditionally clears the volume's dirty state flag , even if errors were previously recorded. In contrast, other paths like ntfs_put_super() only clear this bit when no volume errors are present. A loc...

CVE-2026-98054

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count strace_open() invokes try_module_get() which on success takesthe module reference. If any follow up operation causesstrace_open() to fail, the refcount shall be put down.

CVE-2026-98134

A flaw in the Linux kernel's Berkeley Packet Filter (BPF) verifier allows it to incorrectly infer that a pointer is non-null when it can actually be null at runtime. This occurs during pointer register comparisons (e.g., rA == rB) when one pointer's type lacks the PTR_MAYBE_NULL flag but still al...

CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times The loop initialised next_index from intf->tx_spb_index on everyiteration, so incr_ring() always produced the same result and onlyone slot was ever tested. Move ...

CVE-2026-98109

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_core: Fix race condition during device registration In hci_register_dev(), the power_on work item is queued tohdev->req_workqueue before initializing hdev->adv_monitors_idr andregistering the MSFT extension v...

CVE-2026-98133

A flaw exists in the Linux kernel 's NTFS file system implementation within the ntfs_set_ea() function. The vulnerability occurs because the exit path unconditionally updates the HasEA flag based on ea_info_qsize. If an error happens before ea_info_qsize is updated, the NInoClearHasEA() function ...

CVE-2026-98139

A vulnerability exists in the Linux kernel's NTFS (New Technology File System) driver where the ntfs_cluster_free_from_rl_nolock() function incorrectly increments the nr_freed counter even when ntfs_bitmap_clear_run() fails. Specifically, the function inflates vol->free_clusters when the error...

CVE-2026-98131

A flaw exists in the Linux kernel 's stmmac network driver where a failure during Direct Memory Access (DMA) mapping for packet fragments in stmmac_tso_xmit() causes the driver to drop the frame without unmapping previously created mappings. This results in a DMA mapping leak . A local user could...