CVE-2026-98185

The Linux kernel contains a vulnerability in the mwifiex driver within the mwifiex_ret_802_11_scan() function. The driver fails to validate if fixed response fields and firmware-provided BSS lengths fit within the resp->size before performing subtraction. This logic error can lead to an underf...

CVE-2026-98184

The Linux kernel contains a heap buffer overflow in the mwifiex driver. The mwifiex_cfg80211_authenticate() function incorrectly stores the sum of req->ie_len and req->auth_data_len (both size_t) into a u16 variable. Because NL80211_ATTR_AUTH_DATA lacks a maximum length policy, the sum can ...

CVE-2026-98183

The Linux kernel contains a vulnerability in the wifi: mac80211 component where an out-of-bounds read occurs during the processing of PREQ elements . The root cause is that the function ieee80211_mesh_preq_size_ok() derives the location of bottom fields before verifying if the element contains a ...

CVE-2026-98182

The Linux kernel contains a vulnerability in the mac80211 wifi stack where setting a monitor interface to active on a down interface results in a kernel NULL pointer dereference . The issue occurs because a monitor interface only receives a TXQ if created active; however, the system still allows ...

CVE-2026-98181

The Linux kernel contains an out-of-bounds write vulnerability in the drm/gud component within the gud_plane_atomic_check() function. The issue is caused by a logic error where the num_properties variable is incremented inside a loop while also being used in an index calculation as num_properties...

CVE-2026-98180

The Linux kernel contains a vulnerability in the drm/msm driver where msm_ringbuffer_destroy() and msm_gem_vm_free() use kfree() instead of kfree_rcu() to release objects containing a drm_gpu_scheduler . Because the scheduler fence maintains a .release callback, it is not ops-detached upon signal...

CVE-2026-98179

A vulnerability in the Linux kernel 's drm/amdgpu driver causes a memory leak during device removal. Specifically, the amdgpu_pci_remove() function calls drm_dev_unplug() before fini_sw(), resulting in drm_dev_enter() being false. This causes the iounmap() call, which is guarded by that check, to...

CVE-2026-98178

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the function amdgpu_amdkfd_clear_kfd_mapping() incorrectly assumes a non-NULL kfd_dev has a fully populated node array. This issue occurs when KFD device initialization fails after the probe phase, specifically on Polaris sy...

CVE-2026-98177

The Linux kernel contains an integer underflow vulnerability within the drm/amdkfd component during the EOP ring size calculation . The issue stems from calculating the base-2 logarithm using order_base_2(q->eop_ring_buffer_size / 4) - 1, where order_base_2 could theoretically return 0, causin...

CVE-2026-98176

The Linux kernel contains an integer underflow vulnerability in the drm/amdkfd component. The issue occurs because the base-2 logarithm of the EOP ring size was calculated using a formula that could underflow if the ffs function returned 1 or 0. While the ring buffer size is practically restricte...

CVE-2026-98175

The Linux kernel contains a use-after-free vulnerability in the SMB client component. The root cause is that the clean_demultiplex_info() function fails to cancel the server->reconnect delayed work, while it does cancel server->echo. This allows a use-after-free to occur when the demultiple...

CVE-2026-98174

The Linux kernel contains a vulnerability in the smb client due to a race condition and missing initialization. Specifically, TCP_Server_Info.rlist is allocated via kzalloc, which incorrectly sets ->next and ->prev to NULL instead of pointing to the node itself; this causes list_empty() to ...

CVE-2026-98173

The Linux kernel contains a use-after-free vulnerability in the SMB client component within the cifs_try_adding_channels() function. The issue arises because the function captures the next entry (niface) under iface_lock but then drops the lock for the duration of cifs_ses_add_channel(). A concur...

CVE-2026-98172

The Linux kernel contains a vulnerability in the SMB client where an smbd_connection leak occurs. When an RDMA connection is successfully established via smbd_get_connection() but cifs_get_tcp_session() subsequently fails (for example, if kthread_create() returns an error), the error path incorre...

CVE-2026-98171

The Linux kernel contains a vulnerability in the SMB client during the handling of compound encrypted frames within the receive_encrypted_standard() function. The issue stems from several pointer lifecycle and bounds checking flaws: a stale next_buffer pointer can lead to a use-after-free on cert...

CVE-2026-98170

The Linux kernel contains an out-of-bounds read vulnerability in the smb: client component within the move_smb2_ea_to_cifs() function. The root cause is an insufficient loop condition (while (src_size > 0)) that allows iteration to continue even when the remaining src_size is too small to hold...

CVE-2026-98169

A vulnerability exists in the Linux kernel 's SMB client where the smb3_enum_snapshots() function fails to verify the actual length of a server's reply. Specifically, if snapshot_array_size is smaller than GMT_TOKEN_SIZE, the function sets ret_data_len to the size of struct smb_snapshot_array. Si...

CVE-2026-98168

The Linux kernel contains a vulnerability in the SMB client component within the cifs_query_reparse_point() function. The root cause is an insufficient bounds check where the code verifies that the start pointer is within the response but fails to ensure at least 8 bytes remain for the reparse_da...

CVE-2026-98167

The Linux kernel SMB client contains a vulnerability in receive_encrypted_standard() where server->total_read incorrectly maintains the full decrypted frame size while processing sub-PDUs of a compound encrypted frame . This oversight causes cifs_handle_standard() to pass an incorrect size to ...

CVE-2026-98165

The Linux kernel 's drm/amdgpu driver contains a vulnerability related to the BAR0 fallback read path. This path was originally implemented as a workaround for SR-IOV VFs where the VRAM aperture is unavailable during early initialization. The fix involves restricting this workaround specifically ...