CVE-2026-98014

The Linux kernel contains a vulnerability in the net/mlx5 driver related to E-Switch functionality. During FW-fatal recovery (where dev->state == INTERNAL_ERROR), a failure in esw_update_vport_rx_mode() leaves vport->allmulti_rule intact. This causes esw_update_vport_mc_promisc() to add ent...

CVE-2026-98015

The Linux kernel contains a use-after-free vulnerability in the net/mlx5: E-Switch component within the mlx5_eswitch_termtbl_put() function. The issue arises because the tt->ref_count cleanup check occurs after the termtbl_mutex has been released, allowing a race condition where one caller fre...

CVE-2026-98013

The Linux kernel contains a vulnerability in the net/sched component within the fq_pie qdisc. The fq_pie_change() function improperly accepts any quantum value from userspace, including a value of 1. When combined with a crafted size table where qdisc_pkt_len reaches approximately 2 GiB , a quant...

CVE-2026-98011

The Linux kernel contains a vulnerability in the net/sched: hhf component where the hhf_change() function accepts an unvalidated quantum from userspace. A user with CAP_NET_ADMIN privileges can provide a quantum of 1 combined with a crafted size table to cause the deficit-refill loop to spin appr...

CVE-2026-98012

The Linux kernel contains a vulnerability in the net/sched: sfq component where the sfq_change() function fails to properly restrict the quantum value. By providing a crafted size table causing qdisc_pkt_len to reach approximately 2 GiB, an attacker can set quantum=1 to trigger a deficit-refill l...

CVE-2026-98009

The Linux kernel contains a vulnerability in the net/sched: ets component where the ets_qdisc_change() function falls back to psched_mtu() without a floor for bands lacking an explicit quantum. An attacker with CAP_NET_ADMIN privileges can use a crafted size table to cause qdisc_pkt_len to reach ...

CVE-2026-98010

The Linux kernel contains a vulnerability in the net/sched subsystem where the drr_change_class() function fails to properly clamp the quantum value during a fallback to psched_mtu(). Specifically, while explicit zeros are rejected, the absence of a floor allows a crafted size table to cause qdis...

CVE-2026-98008

The Linux kernel contains a NULL pointer dereference vulnerability within the net: macb driver. When the device tree describes a fixed-link without an "mdio" child node, the macb_mii_init() function returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL . This causes a kern...

CVE-2026-98007

The Linux kernel contains a vulnerability in the bpf_loop() helper function where the nr_loops argument is incorrectly declared as ARG_ANYTHING. This allows privileged programs to pass pointer values instead of scalars. Because the verifier marks these registers as precise, passing a pointer trig...

CVE-2026-98006

The Linux kernel contains a use-after-free vulnerability in the ALSA caiaq USB device driver. The issue arises because the ep1_in_urb (and midi_out_urb) objects are embedded within the snd_usb_caiaqdev structure. When a command fails due to a timeout and snd_card_free() is called to release the c...

CVE-2026-98004

The Linux kernel addresses a vulnerability within the iommu/riscv component related to command queue publishing. The fix ensures that the software producer state only advances after a command is written and the hardware tail is updated. To prevent other CPUs from being blocked by a long poll when...

CVE-2026-98005

The Linux kernel contains a vulnerability within the erofs file system regarding the encoding of inode_share cache keys . Previously, keys were encoded as fingerprint || domain_id, which created ambiguity as the fingerprint could be incorrectly parsed as part of a domain ID. The fix involves chan...

CVE-2026-98003

The Linux kernel contains a vulnerability in the iommu/amd component where GA log buffers are reallocated during every resume operation. The root cause is that the iommu_init_ga_log() function unconditionally assigns pointers to iommu->ga_log and iommu->ga_log_tail, causing a memory leak of...

CVE-2026-98002

The Linux kernel contains a vulnerability in the iommu/amd component due to an ineffective error check during nested domain allocation. The function amd_iommu_pdom_id_alloc() returns an int , which can be a negative errno (such as -ENOSPC) if the ID space is exhausted or memory is short. However,...

CVE-2026-98001

The Linux kernel contains a vulnerability in the hwmon (ltc4282) driver. The ltc428_clk_provider_setup() function fails to fully initialize all members of the clk_init_data structure, specifically leaving init.num_parents uninitialized. This oversight can lead to a system crash , particularly whe...

CVE-2026-98000

The Linux kernel contains a potential Use-After-Free (UAF) vulnerability in the hwmon subsystem specifically within the pec_store() function. The issue occurs because the code uses guard(mutex)(&hwdev->lock) to manage a mutex. If a chip write operation returns an error other than -EOPNOTSUPP, ...

CVE-2026-97998

A vulnerability exists in the Linux kernel 's netfilter: nfnetlink_log component where instances are refcounted, but memory release only occurs during a 1 -> 0 transition , while unlinking from hashes can happen at any refcount. Uncooperative userspace can trigger a race condition by forcing a...

CVE-2026-97997

The Linux kernel contains a vulnerability in the virtio_ring component where a failed packed add can leave stale AVAIL and USED bits in the descriptors. When vring_map_one_sg() fails mid-operation, unmap_release restores flags but leaves descriptors marked as available. This causes the device to ...

CVE-2026-97995

The Linux kernel contains a vulnerability in the virtio_console driver where the remove_vqs() function incorrectly passes leftover cookies to free_buf(). If a control message remains on c_ovq when a device is unbound, free_buf() treats these cookies as struct port_buffer and reads past the ports_...

CVE-2026-97996

A use-after-free vulnerability exists in the Linux kernel within the unregister_virtio_device() function. The issue occurs because device_unregister() drops the last reference to the device, triggering a release callback that frees the memory containing the virtio_device struct for certain transp...