CVE-2026-97551

The Linux kernel 's xfs filesystem contains a vulnerability where xfs_parent_da_args_init() initializes xfs_parent_args with a zeroed value, leaving args->total at 0. During attribute fork growth, xfs_da_grow_inode_int() treats this as a running block reservation; because it is an xfs_extlen_t...

CVE-2026-97550

The Linux kernel contains a logic error in the xfs filesystem regarding per_binval computation. The vulnerability stems from performing unit conversions in the wrong direction: the second parameter of xfs_buf_inval_log_space is expected in bytes , while max_binval is measured in fsblocks . This r...

CVE-2026-97548

The Linux kernel contains a vulnerability within the xfs filesystem regarding the rtrmap and rtrefcount versions of the _maxlevels_ondisk functions. These functions are responsible for computing the size of in-memory btree cursors; however, they fail to account for the inode root . This oversight...

CVE-2026-97549

The Linux kernel XFS filesystem experienced an issue where the system would under-reserve blocks during the repair of shortform (sf) directories . The root cause was an incorrect assignment of the args->total value in xrep_dir_swap_prep, which failed to account for the correct ratio between di...

CVE-2026-97546

The Linux kernel contains a vulnerability in the xfs filesystem where the function xrep_dir_recover_data can enter an infinite loop (spin forever ). This occurs when the system encounters an unused directory entry (dirent ) that claims to have a length of zero during the salvaging process. The pr...

CVE-2026-97547

The Linux kernel contains a vulnerability in the XFS filesystem related to xmi_can_exchange_reflink_flags(). When exchanging two full-file ranges with the XFS_EXCHMAPS_INO1_WRITTEN flag set, the system may incorrectly move the reflink inode flag . This occurs because the operation can skip hole a...

CVE-2026-97545

The Linux kernel contains a vulnerability in the xfs filesystem where xfs_btree_bload_prep_block fails to release new_bp if xfs_btree_bload_drop_buf encounters an IO error during the writing of the delwri buffer list to disk. This flaw results in a lost locked buffer . Remediation is provided via...

CVE-2026-97543

The Linux kernel contains a memory leak vulnerability within the xfs filesystem. Specifically, a memory leak occurs in xchk_dirtree_create_path when a directory path object is created but the operation to append a name to that path fails, resulting in the (empty) seen inode bitmap not being torn ...

CVE-2026-97544

The Linux kernel contains a memory leak vulnerability within the xfs filesystem. Specifically, the function xqcheck_mod_live_ino_dqtrx fails to free a newly allocated dqa object in instances where the rhashtable insertion fails. This flaw results in a memory leak. The vulnerability has been resol...

CVE-2026-97541

The Linux kernel contains a vulnerability in the wifi: ath9k_htc driver. The issue stems from the driver storing usb_device_id , which is not guaranteed to persist longer than the probe process due to the presence of dynamic IDs. The fix involves storing only driver_data , as all other necessary ...

CVE-2026-97542

The Linux kernel contains a vulnerability in the xfs filesystem where the xrep_agfl_fill function fails to check the result of the xagb_bitmap_walk call. This oversight causes the system to silently drop errors and proceed with inconsistent incore data when xagb_bitmap_set fails. The vulnerabilit...

CVE-2026-97540

The Linux kernel contains a vulnerability in the usb pegasus driver where the code incorrectly relies on id table pointer arithmetic when handling dynamic IDs. Because the usb_device_id parameter resides on the heap in these cases, the pointer arithmetic results in an out-of-bounds index . The is...

CVE-2026-97538

The Linux kernel contains a vulnerability in the asus_rog_ryujin hwmon driver. The function rog_ryujin_raw_event() fails to verify the presence of response headers and payload fields in received reports. This allows a short report to cause the driver to consume uninitialized bytes from the HID tr...

CVE-2026-97539

The Linux kernel contains a vulnerability in the xusbatm driver where the code incorrectly relies on id table pointer arithmetic . When dynamic IDs are involved, the usb_device_id parameter resides on the heap, causing pointer arithmetic to result in a wildly out of bound index. To resolve this, ...

CVE-2026-97537

The Linux kernel contains a vulnerability in the scsi qla2xxx driver within the qla25xx_free_req_que() and qla25xx_free_rsp_que() functions. Two specific issues occur on the error path of queue creation: first, an unconditional dma_free_coherent() call with a NULL pointer (resulting from a dma_al...

CVE-2026-97535

The Linux kernel contains a vulnerability in the scsi qla2xxx driver where the qla25xx_ctrlvp_iocb() function performs an out-of-bounds write. The root cause is a lack of bounds checking when computing the map index for the vp_idx_map array (a fixed 16-byte array). If a vp_index above 128 is prov...

CVE-2026-97536

The Linux kernel contains a use-after-free vulnerability in the scsi: qla2xxx driver during queue teardown. The issue occurs because the qla2xxx_delete_qpair() function calls free_irq(), which does not cancel work already placed on the ha->wq workqueue. Consequently, a still-pending q_work may...

CVE-2026-97533

The Linux kernel (x86 architecture) contains a use-after-free vulnerability in the memory management subsystem (x86/mm/pat ). The issue arises from a race condition between attribute changes and CPA collapse ; a lockless page table walker retrieves a PTE entry which can be freed by a concurrent C...

CVE-2026-97534

The Linux kernel contains a vulnerability in the f2fs filesystem related to how it handles free_sections during free_segment_range(). When restricting block allocation to a safe main area during Garbage Collection (GC), the system fails to deduct already-free sections within the truncated range f...

CVE-2026-97532

The Linux kernel contains a vulnerability in the scsi: qla2xxx driver within the qla2x00_mem_alloc() function's error path. When memory allocation fails, the function frees several adapter members (including elsrej.c , purex_dma_pool , and flt ) but leaves the pointers dangling. Consequently, the...