CVE-2026-98215

The Linux kernel contains a vulnerability in SELinux related to how user file SIDs are preserved across nested backing files, such as overlayfs over overlayfs or FUSE passthrough . When mmap() replaces vma->vm_file with a backing file, the system may incorrectly use the SID of the mounter inst...

CVE-2026-98214

A vulnerability in the Linux kernel allows the mprotect() system call to bypass SELinux checks performed by mmap() against intermediate layers of a stacked filesystem . While mmap() validates every backing layer in the stack, mprotect() only references the lowest backing file, skipping intermedia...

CVE-2026-98213

The Linux kernel contains a vulnerability in the mmc core where a host controller using sdio_signal_irq() schedules host->sdio_irq_work from its interrupt handler. This work is only cancelled during suspend, not on the remove/free path. Consequently, a worker armed just before the controller f...

CVE-2026-98212

The Linux kernel contains a use-after-free vulnerability in the mmc: hsq component. Specifically, the mmc_hsq_pump_requests() function queues retry_work when request_atomic() returns -EBUSY (currently implemented by sdhci-sprd). Because this work is embedded in a devm-allocated mmc_hsq but not ca...

CVE-2026-98211

The Linux kernel contains a use-after-free vulnerability within the mmc: mmci component. The issue occurs because ux500_busy_complete() can queue ux500_busy_timeout_work for an R1b command, but mmci_remove() fails to cancel this work, leading to the dereferencing of the devm-allocated mmci_host a...

CVE-2026-98210

The Linux kernel contains a vulnerability in the mxcmmc driver where the mxcmci_remove() function fails to drain the driver's asynchronous state before freeing the host. Specifically, the host->watchdog timer and host->datawork are not explicitly cancelled or deleted during removal. This ca...

CVE-2026-98209

The Linux kernel contains a vulnerability in the mmc: sdhci-of-aspeed driver where probe failures and removals leave SDHCI child devices registered after the parent clock and managed resources are released. The root cause is the improper sequence of resource release; the fix involves unregisterin...

CVE-2026-98208

The Linux kernel contains a memory leak vulnerability in the mmc: sdio_uart component. The function sdio_uart_add_port() allocates a transmit fifo before claiming a slot in the sdio_uart_table[]. If all UART_NR slots are occupied, the function returns -EBUSY while the fifo remains allocated; howe...

CVE-2026-98207

In the Linux kernel , a vulnerability exists in the mmc: spi driver where the mmc_spi_request() function fails to reset the data->bytes_xfered counter during a private recovery path for CRC failures . When a multi-block transfer encounters a CRC error and succeeds on a subsequent internal retr...

CVE-2026-98206

The Linux kernel is affected by a vulnerability where the HID report size provided by a device is used as the length for a memcpy() operation into response_buf . Because the size field originates from the device without prior validation, it could lead to a buffer overflow if it exceeds CY_MAX_INP...

CVE-2026-98205

The Linux kernel contains a vulnerability in the evdev subsystem where the EVIOCSABS handler copies a user-supplied size into an uninitialized on-stack input_absinfo structure. Because the size is controlled by userspace, a short size allows trailing parts of the structure to retain stale stack b...

CVE-2026-98204

The Linux kernel contains an out-of-bounds read vulnerability in the rmi_smb_write_block() function within the rmi_smbus input. The root cause is an incorrect calculation of block_len, where the loop uses the original total length instead of the remaining length (cur_len). When the total length e...

CVE-2026-98202

The Linux kernel contains a vulnerability where transport drivers (rmi_i2c and rmi_spi ) trigger a General Protection Fault (GPF) during system power management events. The issue occurs when rmi_driver_suspend() or rmi_driver_resume() is called on an unbound rmi_dev device. Because the transport ...

CVE-2026-98203

The Linux kernel contains a vulnerability where the system may attempt to access btns_desc->package.elements[0] without first verifying that btns_desc->package.count is non-zero. This issue has been resolved by implementing a check to ensure the count is not 0 before accessing the array ele...

CVE-2026-98200

The Linux kernel contains a use-after-free vulnerability in the hwmon (hp-wmi-sensors) component. The issue occurs because fungible_show() dereferences the nsensor->current_state pointer without holding state->lock, while the update_numeric_sensor_from_wobj() function frees and replaces tha...

CVE-2026-98201

A vulnerability exists in the Linux kernel within the compat path of the input_ff_effect_from_user() function. The issue arises because the function aliases a native struct ff_effect with a smaller struct ff_effect_compat and only copies the compat-sized prefix using copy_from_user(). Consequentl...

CVE-2026-98199

The Linux kernel contains a vulnerability in the hwmon (pmbus/core) component. The issue stems from the system supporting fewer phases than some hardware devices actually possess; specifically, the mp2975 driver supports up to 14 phases and the mp2856 driver supports up to 12 phases. This discrep...

CVE-2026-98197

The Linux kernel contains a vulnerability in the hwmon (w83791d) driver. During the w83791d_probe() process, if the fan/pwm 4-5 pins are not used as GPIO, the driver creates the w83791d_group_fanpwm45 sysfs group. While the probe error path correctly removes this group on failure, the normal remo...

CVE-2026-98198

The Linux kernel contains a vulnerability in the hwmon (pwm-fan) component where the sample_timer() function can access freed memory. This occurs because the cleanup action to stop the RPM timer is registered before the ctx->tachs and ctx->pulses_per_revolution arrays are allocated; since d...

CVE-2026-98196

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the brcmsmac WiFi driver. The issue resides in the brcms_free_timer() function, which calls brcms_del_timer() using the non-synchronous cancel_delayed_work() . If the _brcms_timer callback is already executing, the cancellation...