CVE-2026-98354

A memory leak vulnerability exists in the Linux kernel within the RDMA/mad component. The issue occurs in ib_mad_complete_recv() because ib_mad_enforce_security() is executed before the recv_buf is linked to the rmpp_list. If security enforcement fails, the system calls ib_free_recv_mad(), which ...

CVE-2026-98352

The Linux kernel contains a vulnerability in the RDMA/rtrs-clt component where a CQ pool leak occurs when a connection is interrupted. The issue is caused by a race condition in the ADDR_RESOLVED handler: the client may borrow shared CQ credits via ib_cq_pool_get() before the peer is connected. I...

CVE-2026-98353

The Linux kernel contains a vulnerability in the RDMA/erdma subsystem where locked QP and CQ lookups from EQ interrupts can deadlock with create-path XArray updates. This occurs because if an interrupt arrives while the create path holds a plain xa_lock , the lookup operation spins indefinitely a...

CVE-2026-98351

The Linux kernel contains a memory leak vulnerability in the virt_wifi component. When a simulated link is disconnected, the virt_wifi_start_xmit() function returns NET_XMIT_DROP without freeing the skb . Because dev_hard_start_xmit() treats this return value as consumed, every packet sent while ...

CVE-2026-98350

The Linux kernel contains a vulnerability in the wifi: brcmfmac: cyw component. The root cause is a failure to zero out auth_status during initialization, which allows garbage data to leak from the stack to the firmware. This occurs specifically when the ssid is shorter than 32 bytes and/or when ...

CVE-2026-98349

The Linux kernel contains a vulnerability in the wifi: libipw component within the libipw_process_probe_response() and libipw_network_init() functions. The root cause is an integer underflow where the code assumes a 36-byte beacon/probe response prefix, but the ipw2100 and ipw2200 receive paths o...

CVE-2026-98347

The Linux kernel contains a race condition in the IB/IPoIB driver where ipoib_ib_dev_flush_light() restores the IPOIB_FLAG_OPER_UP flag after a multicast flush. This restore can conflict with ipoib_ib_dev_down(), potentially leaving the flag set after the device is down. Consequently, ipoib_mcast...

CVE-2026-98348

The Linux kernel contains a vulnerability in the wifi: libipw component where the libipw_handle_assoc_resp() function incorrectly computes the information element length. Because stats->len is a u16 and sizeof() returns a size_t , the subtraction stats->len - sizeof(*frame) wraps as a size_...

CVE-2026-98346

The Linux kernel contains a vulnerability in the cfg80211 component where the function cfg80211_calculate_bi_data() calls rdev_get_radio_mask() using wdev->netdev. Because wdev->netdev can be NULL for certain network device types, this leads to a crash in mac80211 . The fix involves inverti...

CVE-2026-98345

The Linux kernel contains a vulnerability within the cfg80211 component, specifically in the cfg80211_classify8021d() function. The issue occurs when a frame mimicking an IP packet is transmitted but is too short, causing the DS field to be read incorrectly. This leads to an uninit-value error as...

CVE-2026-98344

The Linux kernel contains a vulnerability in the dmaengine component involving a device kref underflow in dma_chan_put(). The issue occurs because dma_chan_get() only increments the chan->device->ref on the slow path, while dma_chan_put() drops the reference unconditionally. This causes a m...

CVE-2026-98343

The Linux kernel contains a use-after-free vulnerability in the dmaengine component, specifically within the dma_chan_put() and dma_release_channel() functions. The issue occurs because dma_device_put() can drop the last reference on chan->device->ref, triggering dma_device_release() and fr...

CVE-2026-98342

The Linux kernel dmaengine component contains a vulnerability where dma_device_release() unlinks a device using list_del_RCU() and subsequently frees it without ensuring a grace period. This allows concurrent RCU readers in dma_issue_pending_all() to access the device after it has been freed, pot...

CVE-2026-98341

The Linux kernel 's cfg80211 component is vulnerable to a Use-After-Free (UAF) in scan_done() when an interface goes down during an active scan. The vulnerability occurs because cfg80211 frees the scan request upon completion, but the driver may still believe it owns the request due to the asynch...

CVE-2026-98340

The Linux kernel contains a vulnerability in the cfg80211 WiFi stack where the __cfg80211_bss_update() function incorrectly groups hidden BSSes**. Specifically, it may group a probe response for an unknown BSS with an existing entry that lacks beacon elements, creating a group withou...

CVE-2026-98338

The Linux kernel contains a race condition in the cfg80211 wireless subsystem when joining an IBSS . The issue occurs because the system previously recorded only the BSSID/channel and performed a lookup later; however, a new scan with NL80211_SCAN_FLAG_FLUSH could remove the BSS entry before proc...

CVE-2026-98339

The Linux kernel contains a vulnerability in the wifi: cfg80211 component where stale BSS entries are not correctly filtered during removal. When an associated Access Point (AP) switches to a channel with an existing BSS entry, the function cfg80211_update_assoc_bss_entry() removes the entry to a...

CVE-2026-98337

A vulnerability exists in the Linux kernel 's mac80211 wifi subsystem where ROC (Radio Out Channel) work could be started while a scan is in progress. This occurs because pending ROC work might remain when a scan begins, and new ROCs can be added to the list, potentially causing a warning in net/...

CVE-2026-98336

The Linux kernel contains a vulnerability in the wifi: mac80211 component where the system attempts to offload TC (traffic control) setup to drivers for AP_VLAN interfaces . Because these interfaces are purely virtual, the offload attempt is inappropriate and can fail as the AP interface may be u...

CVE-2026-98335

The Linux kernel contains a vulnerability in the mac80211 wifi subsystem where the ieee80211_stop_mesh() function fails to properly abort a channel switch (CSA) when leaving a mesh. Because the function leaves CSA active while releasing the channel context, it results in a null-pointer dereferenc...