CVE-2026-98053

The Linux kernel contains an out-of-bounds read vulnerability within the ASoC: Intel: avs driver. The issue resides in the avs_path_module_send_init_configs() function, where the code accesses the init_configs array using indexes from the config_ids array. Because these two arrays are limited by ...

CVE-2026-98054

In the Linux kernel, the following vulnerability has been resolved: ASoC: Intel: avs: Fix unbalanced module reference count straceopen invokes trymoduleget which on success takes the module reference. If any follow up operation causes straceopen to fail, the refcount shall be put down...

CVE-2026-98052

A vulnerability exists in the Linux kernel 's bcmasp network driver. The bcmasp_xmit() function fails to clear the txcb->last field for non-final fragments of an SKB , leaving stale data in the descriptor slot. This can cause bcmasp_tx_reclaim() to incorrectly identify a mid-SKB fragment as th...

CVE-2026-98050

The Linux kernel contains a vulnerability in the mlxsw: spectrum_ptp component where mlxsw_sp1_ptp_ht_gc_collect() calls napi_gro_receive() from a PTP garbage-collection workqueue instead of the NAPI poll context. This leads to a race condition because the call mutates the NAPI instance's GRO lis...

CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98049

A vulnerability exists in the Linux kernel BPF (Berkeley Packet Filter) subsystem where the is_cmpxchg_insn() function fails to match BPF_PROBE_ATOMIC mode. When performing a 32-bit atomic compare-and-exchange operation on an arena pointer, the kernel fails to emit an explicit zero extension for ...

CVE-2026-98048

The Linux kernel contains a vulnerability within the bpf subsystem where the mark_fastcall_pattern_for_call() function fails to ensure that "spill; call; fill" instruction series are not interrupted by a jump. This flaw causes the rewrite applied by bpf_remove_fastcall_spills_fills() to be unsoun...

CVE-2026-98047

The Linux kernel contains a vulnerability in the BPF subsystem where bpf_rbtree_add() fails to properly enforce callback restrictions during nested static subprogram calls. Because in_rbtree_lock_required_cb() only checks the innermost verifier frame, a subprogram can push a frame without the in_...

CVE-2026-98045

The Linux kernel contains a vulnerability where the faultable variants of bpf_get_stack() and bpf_get_task_stack() do not correctly set the might_sleep property. This allows these helpers to be called from non-sleepable regions, such as RCU or preemption-disabled regions, because the verifier may...

CVE-2026-98046

The Linux kernel contains a vulnerability where the bpf_btf_find_by_name_kind() helper is incorrectly treated as non-sleepable. Because the helper does not set might_sleep , the BPF verifier allows its use in non-sleepable contexts like BPF timer callbacks . This can lead to a condition where ano...

CVE-2026-98044

The Linux kernel contains a vulnerability in the BPF verifier where legacy packet-load instructions (BPF_LD_ABS or BPF_LD_IND ) used within synchronous callbacks trigger a "callback unexpected regs" verifier bug. Because check_ld_abs() models failed loads as implicit returns with R0 set to zero, ...

CVE-2026-98043

The Linux kernel contains a vulnerability in the bpf subsystem where reg_not_null() incorrectly infers a register as non-NULL by examining its type alone. For pointer types allowing arithmetic, a runtime offset might result in a NULL pointer dereference if the offset is unbounded. The vulnerabili...

CVE-2026-98042

The Linux kernel contains a vulnerability in the bpf subsystem where check_cond_jmp_op() incorrectly handles snapshots of compared registers. Specifically, collect_linked_regs() might call clear_scalar_id() on the compared register if it exceeds the LINKED_REGS_MAX limit. Because the register is ...

CVE-2026-98040

The Linux kernel contains a vulnerability in the BPF verifier where check_cond_jmp_op() incorrectly handles register-form NULL checks . When a nullable pointer rA is compared against a scalar rB known to be zero, the verifier lifts PTR_MAYBE_NULL from rA but fails to mark rB as precise. This allo...

CVE-2026-98041

The Linux kernel contains a vulnerability where the is_branch_taken() function fails to distinguish between BPF_JMP and BPF_JMP32 comparisons. Specifically, when processing a comparison such as if w1 != 0, the system incorrectly reports the jump as always taken. This issue occurs because the kern...

CVE-2026-98039

The Linux kernel contains a vulnerability in the BPF subsystem where map_kptr_match_type() fails to properly validate the MEM_PERCPU flag for BPF_KPTR_PERCPU fields. Because the subset test accepts allocations without the required flag, a plain bpf_obj_new() allocation can be stored in a __percpu...

CVE-2026-98038

The Linux kernel contains a vulnerability in the BPF subsystem where bpf_refcount_acquire() incorrectly treats certain borrowed RCU kptrs as owning references. Specifically, refcounted objects without a graph node appear as owning references even without an acquired state. This allows a program t...

CVE-2026-98037

The Linux kernel contains a vulnerability where a local kptr demoted to PTR_UNTRUSTED after an RCU read-side critical section ends retains the MEM_ALLOC flag. Because type_is_ptr_alloc_obj() recognizes any PTR_TO_BTF_ID with MEM_ALLOC as a live object, a kfunc can erroneously pass a NULL or stale...

CVE-2026-98036

The Linux kernel contains a vulnerability in the BPF subsystem where rhtab_map_update_elem() incorrectly initializes special fields when obtaining an element from bpf_mem_cache_alloc() . Because the allocator can return a recycled unit from RCU-pending lists before its destructor runs, reinitiali...

CVE-2026-98034

The Linux kernel contains a vulnerability where the BPF verifier fails to mark a register as precise when it is known to contain zero during a scalar store into an untrusted kptr field. Because check_map_kptr_access() does not mark the register as precise, a state checkpoint with an imprecise zer...