CVE-2026-97500

The Linux kernel contains a vulnerability in the rtw89 wifi driver. The phy component fails to validate the length of the PHY status IE reported by hardware before parsing, which could allow the parser to access out of range memory. The issue has been resolved in the kernel via commits providing ...

CVE-2026-97499

The Linux kernel contains a vulnerability in the coresight: perf component. The issue arises because ETM perf callbacks currently use the per-CPU csdev_src pointer , which is susceptible to a race condition during device registration and unregistration. To resolve this, the fix utilizes the path ...

CVE-2026-97498

The Linux kernel contains a vulnerability in the drm/amdgpu/userq component where mqd and fw objects (queue core objects) were not properly pinned to avoid eviction. If these buffers were evicted while the hardware continued to use the invalid addresses, it resulted in page faults and system hang...

CVE-2026-97497

The Linux kernel contains a vulnerability within the drm/amdkfd component. The allocate_sdma_queue function failed to perform bounds-checking on the restore_sdma_id option, which is used by CRIU . This oversight allowed for the specification of an sdma queue id exceeding the maximum number of que...

CVE-2026-97496

The Linux kernel contains an out-of-bounds (OOB) memory exposure vulnerability in the drm/amdkfd component within the get_wave_state() function for v9. The root cause is that the function trusts cp_hqd_cntl_stack_size and cp_hqd_cntl_stack_offset values read from the MQD, which are fully attacker...

CVE-2026-97495

The Linux kernel contains a vulnerability in the drm/amdkfd component where the allocated_doorbell option, used by CRIU to set a specific doorbell id, lacks proper bounds checking. The issue is addressed by confirming that the value is less than KFD_MAX_NUM_OF_QUEUES_PER_PROCESS . While the root ...

CVE-2026-97494

The Linux kernel contains a vulnerability in the drm/amdgpu driver related to the psp_copy_fw function. The issue stems from a lack of validation when handling PSP fw_pri_buf copies, where the function previously failed to properly check for errors during drm_dev_enter or validate image sizes. To...

CVE-2026-97493

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the bound GPIO I2C table entry count is sourced from the VBIOS . This can lead to a buffer overrun of adev->i2c_bus[] if the table is undersized or the count is excessively large due to corrupt size fields. The fix involv...

CVE-2026-97492

A vulnerability exists in the Linux kernel 's mac80211 component where calling ieee80211_handle_reconfig_failure during a failed NAN reconfiguration causes all interfaces to be marked as not in the driver. This leads to dangling pointers to objects like stations and links (specifically noted for ...

CVE-2026-97491

The Linux kernel contains a vulnerability in the net/rds component where the rds_ib_conn_path_shutdown function improperly sleeps. Specifically, a shutdown worker thread uses a wait_event call that blocks other work items in the queue, leading to a system hang during the teardown of IB network co...

CVE-2026-97490

The Linux kernel contains a vulnerability where the affs filesystem fails to correctly handle set_blocksize failures. The issue stems from the use of buffer_heads , which do not properly manage block sizes exceeding PAGE_SIZE . This leads to a BUG_ON condition during the first __bread_gfp call in...

CVE-2026-97489

The Linux kernel contains a vulnerability in the bfs filesystem regarding how it handles set_blocksize failures. The issue arises because buffer_heads do not effectively manage block sizes exceeding PAGE_SIZE . This flaw can trigger a BUG_ON condition in folio_set_bh during the first greead_gfp ...

CVE-2026-97488

The Linux kernel contains a vulnerability in the qnx4 filesystem where buffer_heads do not properly handle block sizes greater than PAGE_SIZE . This issue causes a BUG_ON(offset >= folio_size(folio)) error during the first __bread_gfp call in folio_set_bh , leading to a failure when mounting....

CVE-2026-97487

A vulnerability exists in the Linux kernel 's jfs file system. The issue arises because jfs uses buffer_heads , which do not properly handle block sizes greater than PAGE_SIZE . This incompatibility causes a kernel bug (BUG_ON ) during the folio_set_bh call when the first __bread_gfp is ...

CVE-2026-97486

The Linux kernel 's hpfs filesystem contains a vulnerability because it uses buffer_heads , which do not properly handle block sizes exceeding PAGE_SIZE . This issue causes a BUG_ON condition in folio_set_bh during the first __bread_gfp call when mounting. The vulnerability has been resolved in t...

CVE-2026-97485

The Linux kernel contains a vulnerability in the omfs filesystem component where buffer_heads do not correctly handle block sizes greater than PAGE_SIZE . This flaw can lead to a BUG_ON crash in folio_set_bh during the first __bread_gfp call when mounting. The issue has been addressed in recent k...

CVE-2026-97483

The Linux kernel contains a vulnerability in the usb core hcd component that can lead to a possible deadlock during rh control transfers . The issue occurs because memory allocations within the SCSI error handler must not trigger IO. When handling errors in UAS and the storage driver, resetting a...

CVE-2026-97484

The Linux kernel contains a NULL pointer dereference vulnerability in the usbip: vhci_hcd component. The issue occurs because platform_get_drvdata() can return NULL if a VHCI host controller's probe fails (e.g., due to USB bus number exhaustion). The status_show_vhci() function fails to check for...

CVE-2026-97482

The Linux kernel contains a vulnerability in the goku_udc USB gadget driver where the goku_irq() function performs a NULL pointer dereference . The issue occurs when an INT_USBRESET event is received before a gadget driver is bound or after it has been unbound. In these scenarios, dev->driver ...

CVE-2026-97481

The Linux kernel contains a vulnerability in the serial: 8250 driver where the host can experience an ISR soft lockup during the startup phase. This occurs when the host is flooded with messages because the driver fails to handle the FIFO error IRQ (FIFOE) ; reporting IRQ_HANDLED without proper h...