CVE-2026-98326

The Linux kernel contains a vulnerability in the wifi: mac80211: mesh component where the ieee80211_join_mesh() function acquires a channel context but fails to release it if the subsequent ieee80211_start_mesh() call fails. This improper handling leads to a warning during interface removal becau...

CVE-2026-98325

The Linux kernel contains a vulnerability in the wifi: mac80211 component where failed socket buffer (SKB) structures were not properly reported to userspace during certain failure paths. The issue stems from the timing of TX information setup; specifically, the skb->cb[] array was not initial...

CVE-2026-98323

The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...

CVE-2026-98324

The Linux kernel contains a vulnerability within the dmaengine: pxa component caused by double counting of hardware descriptors . Specifically, when pxad_alloc_desc() was converted to use kzalloc_flex(), it began setting the sw_desc->nb_desc counter automatically in newer compilers (GCC 15.1+ ...

CVE-2026-98322

The Linux kernel contains a vulnerability in netfilter: nft_nat where the nft_nat_setup_netmap() function fails to fully initialize the new_addr variable. Specifically, for IPv4 mapping , only the 4-byte .ip member is written to an on-stack union nf_inet_addr. However, the code subsequently copie...

CVE-2026-98321

The Linux kernel contains a vulnerability in the netfilter: nf_nat component where a failure in nf_hook_entries_insert_raw() prevents NAT hooks from being released. This flaw results in a memory leak . The issue is addressed by postponing the setting of nat_proto_net->nat_hook_ops during hook ...

CVE-2026-98320

The Linux kernel is affected by a vulnerability in the netfilter flowtable component. The root cause is that nf_ct_put() releases the ct->ext area immediately, which allows the datapath to potentially refer to the incorrect conntrack due to rcu typesafe semantics. To resolve this, the kernel m...

CVE-2026-98320 netfilter: flowtable: hold reference on ct until flow is released

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

CVE-2026-98318

The Linux kernel contains a vulnerability in the smb client where absolute native symlink targets are not properly validated before NT fixups when symlinkroot is unset. Because the code incorrectly assumes an NT prefix is present, providing a target like "/ab" causes out-of-bounds writes to the s...

CVE-2026-98319

The Linux kernel contains a memory leak vulnerability in the DRM (Direct Rendering Manager) subsystem. When an out_fence_ptr is provided without the DRM_MODE_PAGE_FLIP_EVENT flag set, a drm_pending_vblank_event is allocated. If a subsequent failure occurs during setup_out_fence() , the event fail...

CVE-2026-98317

The Linux kernel contains a vulnerability in the neighbour component where the NDTPA_INTERVAL_PROBE_TIME_MS parameter lacks proper validation. Specifically, the lack of a .validation_type allowed values like 0 to be accepted. Additionally, a u64 to u32 silent cast in nla_get_msecs() allowed large...

CVE-2026-98316

The Linux kernel contains a race condition in the ALSA: bcd2000 driver. During a USB disconnect, a Use-After-Free (UAF) vulnerability can occur because the rawmidi trigger callback might still access a URB (USB Request Block) while the driver handles the disconnect. The root cause is that the pre...

CVE-2026-98316 ALSA: bcd2000: Fix race between rawmidi and disconnect

In the Linux kernel, the following vulnerability has been resolved: ALSA: bcd2000: Fix race between rawmidi and disconnect Although we tried to fix the potential UAF issues at USB disconnect on bcd2000 driver, there is still an overlooked case -- namely, when a rawmidi trigger callback has been...

CVE-2026-98315

The Linux kernel contains a vulnerability in the ntfs filesystem driver where ntfs_non_resident_attr_shrink() fails to hold the runlist write lock while freeing clusters and truncating the runlist. This lack of synchronization can lead to race conditions during runlist updates. Additionally, ntfs...

CVE-2026-98315 ntfs: protect runlist updates with the runlist lock

In the Linux kernel, the following vulnerability has been resolved: ntfs: protect runlist updates with the runlist lock ntfsnonresidentattrshrink calls runlist helpers that require the runlist write lock, but did not hold it while freeing clusters and truncating the runlist. Serialize those...

CVE-2026-98313 drm/msm/dp: skip PUSH_IDLE when the link was never enabled

In the Linux kernel, the following vulnerability has been resolved: drm/msm/dp: skip PUSHIDLE when the link was never enabled msmdpdisplayatomicenable returns early when link training fails, leaving -poweron false and the main link down. msmdpdisplayatomicdisable nevertheless writes...

CVE-2026-98314 ALSA: pcm: set timer->private_data before registering the PCM timer

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: set timer-privatedata before registering the PCM timer sndpcmtimerinit calls snddeviceregister to link the new struct sndtimer into the global timer list while it still carries hw.cresolution = sndpcmtimerresolution an...

CVE-2026-98313

The Linux kernel contains a vulnerability in the drm/msm/dp driver where msm_dp_display_atomic_disable() writes DP_STATE_CTRL_PUSH_IDLE even if link training fails and the link was never enabled. Because this specific write is not gated on the power_on flag, the controller's runtime-PM reference ...

CVE-2026-98314

The Linux kernel contains a vulnerability in the ALSA subsystem where snd_pcm_timer_init() calls snd_device_register() before assigning timer->private_data. This creates a brief window where the timer is visible on the global list while its private_data pointer is still NULL . Concurrent reade...

CVE-2026-98312

The Linux kernel contains an out-of-bounds (OOB) write vulnerability in the ALSA 6fire driver within the usb6fire_pcm_in_urb_handler() function. The issue stems from a calculation of outgoing isochronous packet sizes where a device-reported actual_length of less than 4 causes an integer wrap-arou...