CVE-2026-97579

The Linux kernel contains a vulnerability in the mediatek vcodec component. Specifically, the function vdec_av1_slice_setup_tile() fails to validate that the number of entries copied from the bitstream tile_info (calculated as tile_cols + 1 and tile_rows + 1) does not exceed the capacity of the m...

CVE-2026-97580

The Linux kernel contains a vulnerability in the rkvdec media driver where HEVC tile loops and PPS IDs were not properly bound to the array capacity. Specifically, the functions compute_tiles_uniform() and compute_tiles_non_uniform() looped over entries based on untrusted PPS data, and assemble_h...

CVE-2026-97578

The Linux kernel contains a vulnerability in the Verisilicon Rockchip VPU981 AV1 decoder. The function rockchip_vpu981_av1_dec_set_tile_info() improperly handles cases where tile_cols (derived from the bitstream) is zero, leading to a division by zero error. Additionally, the function fails to pr...

CVE-2026-97577

The Linux kernel contains a vulnerability in the rockchip AV1 decoder driver. Specifically, the function rockchip_vpu981_av1_dec_set_tile_info() fails to properly validate the number of tiles in an AV1 frame against the submitted entry count and the maximum capacity of the AV1_MAX_TILES buffer. T...

CVE-2026-97576

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless HEVC decoders fail to bound u8 counts for num_tile_columns_minus1 and num_tile_rows_minus1 . Specifically, the std_validate_compound() function does not validate these counts, allowing them to be used as tile-lo...

CVE-2026-97575

The Linux kernel contains a vulnerability in the v4l2-ctrls component where stateless AV1 decoders fail to properly bound the tile_info.tile_cols and tile_info.tile_rows fields within std_validate_compound(). These fields are used as loop bounds, array indices for mi_*_starts[] and *_in_sbs_minus...

CVE-2026-97574

The Linux kernel contains a vulnerability in the bnxt_en driver where the bnxt_queue_mem_alloc() function performs a shallow copy of the live RX ring into a clone. Because the rx_tpa and rx_tpa_idx_map pointers are not cleared during this copy, they continue to point to the memory of the live rin...

CVE-2026-97573

The Linux kernel contains a vulnerability in the bnxt_en driver. The function bnxt_rx_ring_reset() fails to properly handle memory allocation errors when reallocating ring buffers. Specifically, bnxt_alloc_one_rx_ring() can return -ENOMEM during bnxt_alloc_one_tpa_info_data(), leaving the rxr-&gt...

CVE-2026-97572

The Linux kernel contains a vulnerability in the bnxt_en driver where bnxt_init_nic() fails to propagate errors from bnxt_init_rx_rings(). Specifically, if bnxt_alloc_one_rx_ring() fails, the return value is ignored, allowing bnxt_init_chip() to enable TPA (TCP Segmentation Offload) on a partiall...

CVE-2026-97571

The Linux kernel contains a vulnerability in the bnxt_en driver within the bnxt_queue_mem_alloc() function. The issue stems from bnxt_alloc_one_tpa_info_data() returning -ENOMEM upon a single allocation failure while leaving remaining rxr->rx_tpa[] entries zeroed. Because bnxt_queue_mem_alloc(...

CVE-2026-97570

The Linux kernel contains a vulnerability in the bnxt_en driver where 57608 NICs with firmware version 233 can experience a crash at boot . The issue arises because the bnxt_alloc_agg_idx function can produce a software ID exceeding the 32 entries allocated for rx_tpa, leading to an out-of-bounds...

CVE-2026-97569

The Linux kernel contains a vulnerability in the bnxt_en driver where a burst of packets can cause the queue to stop permanently. This occurs because the driver may defer completions for all packets in a small ring (

CVE-2026-97568

The Linux kernel contains a vulnerability within the mptcp component related to syncookies. The root cause is the use of an uninitialised bit when copying information in the subflow_ulp_clone() function. To resolve this, the backup flag from struct mptcp_subflow_request_sock is now correctly hand...

CVE-2026-97566

The Linux kernel contains a vulnerability in the in-kernel MPTCP path manager where removing the id 0 endpoint fails to tear down pending announcements. This asymmetry between the id 0 path and non-zero id paths leaves a stale ADD_ADDR announcement entry alive. When the path manager later reselec...

CVE-2026-97567

The Linux kernel contains a vulnerability where a race condition can occur between the disconnect() and rtx events within the mptcp component. This race condition can lead to an inconsistent status . The issue is resolved by implementing a synchronous timer stop operation to prevent the concurren...

CVE-2026-97565

The Linux kernel contains a vulnerability in the CIFSSMBRead() function where it fails to verify that a complete READ_RSP has been received from a server. Specifically, the code dereferences DataLengthHigh , DataLength , and DataOffset without ensuring the response length is at least read_rsp_siz...

CVE-2026-97564

The Linux kernel contains a vulnerability in the SMB client where the cifs.idmap key type lacks a vet_description hook. This allows userspace to create keys via request_key(2) or add_key(2) containing authority-bearing fields (such as SIDs and uid/gid values) that are improperly treated as kernel...

CVE-2026-97563

The Linux kernel contains a vulnerability in the SMB1 synchronous read helper CIFSSMBRead() . The function fails to validate the DataOffset field, allowing a malicious or compromised SMB1 server to provide a large DataOffset with an in-range DataLength . This can cause memcpy() to read past the e...

CVE-2026-97562

The Linux kernel contains a vulnerability in the smb client where a race condition exists during DFS automount expiry . Specifically, tcon_super_cb() stores a raw superblock pointer, but __cifs_get_super() fails to take the active reference until after iterate_supers_type() has dropped the s_umou...

CVE-2026-97561

The Linux kernel contains a vulnerability where the SMB client fails to honor forceuid and forcegid mount options. Specifically, the functions smb311_posix_info_to_fattr(), cifs_posix_to_fattr(), and parse_sec_desc() unconditionally called sid_to_id(), allowing server-provided values to overwrite...