CVE-2026-98255

The Linux kernel contains a vulnerability where old Acknowledgements (ACKs) could bypass the fast path of the TCP stack. Specifically, ACKs before SND.UNA and after SND.NXT were not being properly validated, potentially allowing them to modify connection state or advance RCV.NXT prematurely. The ...

CVE-2026-98254

The Linux kernel contains a vulnerability in the swiotlb component within the swiotlb_bounce() function. The issue arises because the highmem branch incorrectly mixes the page frame number from the original address with the offset from the adjusted address. When an adjustment crosses a page bound...

CVE-2026-98253

The Linux kernel is vulnerable to a race condition in the RDMA/ucma component during concurrent JOIN_MCAST calls. The root cause is that ucma_process_join() previously released ctx->mutex after a successful join, allowing two concurrent calls with the same address to insert a second CMA entry....

CVE-2026-98252

The Linux kernel contains a refcount bug in the RDMA/core component within the iwpm_get_nlmsg_request() function. The vulnerability is caused by the function initializing the refcount after calling list_add_tail(), which allows another CPU to access the global list and perform a kref_get() on the...

CVE-2026-98250

The Linux kernel contains a vulnerability in nfsd related to the handling of NFSEXP_PNFS within the netlink codepath . The issue arose because a previous rework of block layout checks moved the NFSEXP_PNFS check out of nfsd4_setup_layout_type() into its callers, but that patch failed to account f...

CVE-2026-98251

The Linux kernel is vulnerable in the openvswitch component due to an issue in ovs_ct_get_conn_labels(). The function incorrectly adds a labels extension to confirmed conntracks that lack one. Because confirmed conntracks can be read locklessly, adding this extension may trigger a reallocation an...

CVE-2026-98249

The Linux kernel contains a vulnerability in the arm64 architecture during hibernation. The function swsusp_arch_suspend_exit() fails to pass the required arguments for HVC_SET_VECTORS when reinstalling the restored kernel's hyp stub vectors. Because x0 and x1 registers are not correctly set, the...

CVE-2026-98247

The Linux kernel contains a vulnerability in the Bluetooth hci_codec component. The Read Local Supported Codecs parsers incorrectly consume variable-sized standard codec arrays before parsing the vendor codec count. Because the initial reply-size check does not guarantee the vendor count byte rem...

CVE-2026-98248

The Linux kernel contains a vulnerability in the arm64 architecture regarding percpu operations. Specifically, the assembly for __percpu_##name##_case_##sz() and __percpu_##name##_return_case_##sz() fails to use the 'sfx' macro argument when forming LSE instructions . This omission causes {8,16}-...

CVE-2026-98246

A use-after-free vulnerability exists in the Linux kernel Bluetooth stack within the hci_sync component. The hci_dev_close_sync() function clears the hdev->local_codecs list after releasing the hdev->lock, whereas additions and traversals in sco_sock_getsockopt() correctly acquire this lock...

CVE-2026-98245

The Linux kernel contains a vulnerability in the btrfs filesystem. The function mark_block_group_to_copy() iterates over the commit root while skip_locking is set to true. This allows a concurrent transaction commit to swap and free the commit root during iteration, resulting in a use-after-free ...

CVE-2026-98244

The Linux kernel btrfs filesystem contains a vulnerability where the btrfs_rebuild_free_space_tree() function fails to clear the BTRFS_FS_CREATING_FREE_SPACE_TREE flag on certain error paths. Specifically, a transaction restart failure can leave this flag set on a live filesystem, which results i...

CVE-2026-98243

A vulnerability exists in the Linux kernel 's dma-buf/dma-fence component. A previous patch intended to prevent a NULL pointer dereference by testing the ops pointer instead of the signaled bit inadvertently removed RCU protection for many dma_fence implementations. This loss of protection can le...

CVE-2026-98242

A vulnerability in the Linux kernel dma-buf subsystem allows for a silent overflow when the MMIO size exceeds 4G during peer-to-peer DMA through a host bridge. The root cause is that mapped_len was declared as a 32-bit unsigned int, causing a wrap-around when accumulating size_t lengths. This tru...

CVE-2026-98241

The Linux kernel is vulnerable to an out-of-bounds read in the ipv6: xfrm component. The functions xfrm6_local_rxpmtu() and xfrm6_local_error() incorrectly assume that skb->sk always points to a full IPv6 socket. In scenarios where TCP SYN-ACK packets are owned by a TCP_NEW_SYN_RECV request_so...

CVE-2026-98240

The Linux kernel contains a vulnerability in the net: ip_tunnel component where options_len is used to calculate an option pointer before being initialized. This oversight leads to a buffer overflow during a memcpy operation, specifically when processing geneve_opts . This issue can trigger a ker...

CVE-2026-98239

The Linux kernel contains a use-after-free vulnerability in the lan743x network driver. The issue occurs in lan743x_rx_process_buffer() when a packet spans multiple receive buffers; specifically, lan743x_rx_trim_skb() frees fragment skb metadata on the last descriptor, but the checksum-success pa...

CVE-2026-98237

The Linux kernel contains a vulnerability in the mhi_wwan_mbim driver where the mhi_mbim_rx() function fails to adequately validate NDP traversal offsets. A modem that points an NDP at itself or an earlier NDP can cause an infinite loop, pinning one CPU at 100% utilization and preventing the thre...

CVE-2026-98238

The Linux kernel contains an out-of-bounds read vulnerability in the t7xx wwan driver. The t7xx_ccmni_recv_skb() function fails to perform a bounds check on the netif index carried in the DPMAIF PIT header . Because the index is five bits wide but the ccmni_inst[] array only supports up to NIC_DE...

CVE-2026-98236

The Linux kernel contains a vulnerability in the mhi_wwan_mbim driver. The mhi_mbim_rx() function fails to check the return value of skb_copy_bits() when copying datagrams from the NTB . Because the DPE is only checked against the NTB boundaries, a modem can provide an offset pointing outside the...