CVE-2026-98082

In the Linux kernel, the following vulnerability has been resolved: btrfs: fix the possible bioclist memory leak during error There are two possible ways to leak bioc memory on btrfsorderedextent::bioclist: - An error occurred for btrfsinsertoneraidextent Then the function btrfsinsertraidextent...

CVE-2026-98081

A vulnerability exists in the Linux kernel 's btrfs filesystem involving the zoned feature. The root cause is that do_zone_finish() clears the BLOCK_GROUP_FLAG_ZONE_IS_ACTIVE flag but returns early if call_zone_finish() fails. This results in a reference leak for inactive block groups on fs_info-...

CVE-2026-98080

In the Linux kernel, the following vulnerability has been resolved: btrfs: do not force reloc root creation during qgroupaccountsnapshot BUG When running btrfs/252 with quota enabled through MKFSOPTIONS="-O quota", it has a high chance to trigger the following kernel warning and flips the fs RO:...

CVE-2026-98078

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix reversed sequence option serialization htonseq expects the host-order source first and the unaligned network-order destination second. The version 1 sync sender passes these arguments in reverse for both sequence blocks...

CVE-2026-98079

The Linux kernel contains a concurrency issue in the btrfs: zstd component where a writer can sleep indefinitely in zstd_get_workspace(). The root cause is a lost wakeup occurring because zstd_alloc_workspace() fails and the task queues unconditionally on zwsm->wait without re-testing the pool...

CVE-2026-98077

The Linux kernel contains an out-of-bounds (OOB) read vulnerability in the netfilter: nf_conntrack_sip component. The root cause is located in the sip_skip_whitespace() function, which fails to return NULL when its loop exhausts the buffer (where dptr == limit). Because the calling function ct_si...

CVE-2026-98076

The Linux kernel is vulnerable to a use-after-free issue in the tracing/probes component. The root cause resides in traceprobe_define_arg_fields(), which stores pointers to probe argument name/type strings without copying them. When multiple probes share a dynamic event (kprobe, uprobe, eprobe, o...

CVE-2026-98075

The Linux kernel contains a vulnerability where the fixups.c:jit_subprogs() function fails to rewrite BPF_PSEUDO_FUNC loads for the main program when env->subprog_cnt is not greater than 1. This allows a program to reference the main function as a callback (e.g., via bpf_timer_set_callback()),...

CVE-2026-98074

The Linux kernel contains a vulnerability in the bonding driver where __bond_release_one() prematurely clears bond->curr_active_slave to NULL during bond destruction when releasing all slaves. If a backup slave is released before the active slave, the system fails to call bond_alb_handle_activ...

CVE-2026-98073

The Linux kernel contains a vulnerability where conflicting altnames for dying network namespaces are not properly removed in __dev_change_net_namespace(). This issue was reported by syzbot in cfg80211_pernet_exit(). Specifically, when two devices in different network namespaces share the same al...

CVE-2026-98072

The Linux kernel contains a vulnerability in the net/rds component where the release_in_xmit() function fails to maintain necessary memory ordering. Specifically, it uses clear_bit_unlock() to clear RDS_IN_XMIT, which lacks the full barrier required for a subsequent load of the wait queue head. T...

CVE-2026-98071

The Linux kernel contains a data race in the net/rds component within the rds_conn_path_reset() function. The vulnerability stems from the use of a plain store (cp->cp_flags = 0) to wipe the flag word, while other accessors use atomic bitops concurrently. This race condition can cause updates ...

CVE-2026-98070

The Linux kernel contains a vulnerability in the net/rds component where rds_tcp_reset_callbacks() fails to properly quiesce the transmit path. On weakly ordered architectures, the function's reliance on sampling the RDS_IN_XMIT bit rather than owning it creates a store-buffering pattern. This al...

CVE-2026-98069

The Linux kernel is vulnerable to a race condition in the RDS (Reliable Datagram Sockets) subsystem within net/rds. Specifically, rds_conn_shutdown() fails to properly own the fastpath bit locks (RDS_IN_XMIT and RDS_RECV_REFILL ) while quiescing the transmit and receive-refill paths. On weakly or...

CVE-2026-98068

The Linux kernel contains a race condition in the RDS (Reliable Datagram Sockets) protocol. Specifically, the rds_conn_shutdown() function could prematurely consume an RDS_CONN_ERROR state caused by a concurrent drop. This occurs when rds_tcp_accept_one() attaches a new socket; if a concurrent dr...

CVE-2026-98067

The Linux kernel 's erofs filesystem was found to have a broken optimization where LZ4 rolling decompression could compromise data correctness. This occurred because the upstream LZ4 implementation might copy long literals backward on x86 systems, violating the rolling window assumption. To ensur...

CVE-2026-98065

The Linux kernel contains a vulnerability where key-less BTF (Type ID 0) can be created for hash maps (htab and rhtab ). This occurs because these maps gained a ->map_check_btf callback that fails to validate the key, allowing the creation of maps that were previously rejected. When reading th...

CVE-2026-98066

The Linux kernel 's caiaq audio driver contains a vulnerability where the resource management logic for handling errors can result in a double-free condition. Specifically, certain audio resources, such as URBs , may have been previously freed, yet the driver attempts to release them again during...

CVE-2026-98064

The Linux kernel contains a NULL-pointer dereference vulnerability within the BPF subsystem. The issue occurs in btf_modifier_show() when it attempts to call the show() operation on a void type (type_id 0, BTF_KIND_UNKN). Because the kind_ops[] array lacks an entry for this type, the pointer is N...

CVE-2026-98063

The Linux kernel contains a NULL pointer dereference vulnerability in the btf_var_show() function. The issue occurs because btf_var_show() unconditionally calls btf_type_id_resolve() , which dereferences btf->resolved_ids . This pointer is NULL for base BTF structures, such as the vmlinux BTF ...