CVE-2026-98698

• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98836
  • ALSA: line6: reject oversized playback packets {CVE-2026-98836}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98524
  • rds: ib: Clear the sg list when mapping an MR fails {CVE-2026-98524}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98850
  • net/packet: prevent TX_RING byte count overflow {CVE-2026-98850}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98698
  • wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98569
  • ip_gre: Reject enabling collect metadata through changelink {CVE-2026-98569}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98567
  • net: xps: reject an out of range traffic class {CVE-2026-98567}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
• CVE-2026-98838
  • vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838}
• CVE-2026-98578
  • nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578}
• CVE-2026-98583
  • nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583}
• CVE-2026-98612
  • net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612}
• CVE-2026-98722
  • mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722}
• CVE-2026-98657
  • iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657}
• CVE-2026-98623
  • drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623}
• CVE-2026-98732
  • Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732}
• CVE-2026-98393
  • net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
• CVE-2026-53255
  • Bluetooth:…

• CVE-2026-46267
  • nfc: hci: shdlc: Stop timers and work before freeing context {CVE-2026-46267}
• CVE-2026-53004
  • sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks {CVE-2026-53004}
• CVE-2026-98716
  • KVM: SVM: Use the active VMCB's MSR bitmap when checking if MSR is intercepted {CVE-2026-98716}
• CVE-2026-98714
  • KVM: SVM: Update control fields on #VMEXIT if and only if VMRUN succeeded {CVE-2026-98714}
• CVE-2026-98715
  • KVM: SVM: Preserve TLB control (i.e. pending TLB flush) on failed VMRUN {CVE-2026-98715}
• CVE-2026-98662
  • iio: light: gp2ap020a00f: drain irq_work after free_irq {CVE-2026-98662}
• CVE-2026-98430
  • RDMA/efa: Keep admin queues alive while IRQ is registered {CVE-2026-98430}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
• CVE-2026-98763
  • usb: core: clear both ep_in and ep_out for non-ep0 control endpoints {CVE-2026-98763}
• CVE-2026-46064
  • ibmasm: fix heap over-read in ibmasm_send_i2o_message() {CVE-2026-46064}
• CVE-2026-98621
  • net: gue: reject invalid REMCSUM offsets {CVE-2026-98621}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98771
  • usb: storage: sierra_ms: reject short SWoC info transfers {CVE-2026-98771}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-53149
  • thunderbolt: Bound root directory content to block size {CVE-2026-53149}
• CVE-2026-46163
  • wifi: b43legacy: enforce bounds check on firmware key index in RX path {CVE-2026-46163}
• CVE-2026-52962
  • ceph: fix a buffer leak in __ceph_setxattr() {CVE-2026-52962}
• CVE-2026-98386
  • scsi: qla2xxx: Use memset_io() to clear QLAFX00 request ring slot {CVE-2026-98386}
• CVE-2026-45916
  • power: supply: sbs-battery: Fix use-after-free in power_supply_changed() {CVE-2026-45916}
• CVE-2026-98555
  • llc: fix skb UAF and leaks on llc_mac_hdr_init() failure {CVE-2026-98555}
• CVE-2023-54243
  • netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243}
• CVE-2026-53255
  • Bluetooth: MGMT: validate advertising TLV before type checks {CVE-2026-53255}
• CVE-2026-98409
  • watchdog: rtd119x: Avoid division by zero {CVE-2026-98409}
• CVE-2026-98598
  • ipv6: Prevent rt6_insert_exception() for dying fib6_info. {CVE-2026-98598}
• CVE-2026-53392
  • NFSv4/flexfiles: reject zero filehandle version count {CVE-2026-53392}
• CVE-2026-98422
  • wifi: mac80211: reset the AP_VLAN tailroom counter on ifdown {CVE-2026-98422}
• CVE-2026-98393
  • net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
• CVE-2026-53129
  • fs/mbcache: cancel shrink work before destroying the cache {CVE-2026-53129}
• CVE-2023-53794
  • cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2023-53794}
• CVE-2026-98494
  • net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read {CVE-2026-98494}
• CVE-2026-98428
  • ALSA: usb: 6fire: Avoid embedded URBs {CVE-2026-98428}
• CVE-2026-53157
  • net: phonet: free phonet_device after RCU grace period {CVE-2026-53157}
• CVE-2026-98709
  • wifi: mac80211: count only matching reservations in reserved switch {CVE-2026-98709}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98811
  • net/sched: cls_api: reclaim an empty proto on the error path {CVE-2026-98811}
• CVE-2026-43042
  • mpls: add seqcount to protect the…

• CVE-2026-98706
  • wifi: mac80211: drain PS delivery work during station teardown {CVE-2026-98706}
• CVE-2026-98836
  • ALSA: line6: reject oversized playback packets {CVE-2026-98836}
• CVE-2026-98548
  • sctp: discard the rest of the packet on a stale-cookie error {CVE-2026-98548}
• CVE-2026-98614
  • sctp: avoid livelock while updating retransmit path {CVE-2026-98614}
• CVE-2026-98610
  • net/sched: sch_hfsc: bound the classify inner-filter walk with a drift budget {CVE-2026-98610}
• CVE-2026-98524
  • rds: ib: Clear the sg list when mapping an MR fails {CVE-2026-98524}
• CVE-2026-98547
  • af_packet: fix integer overflow in prb_calc_retire_blk_tmo() {CVE-2026-98547}
• CVE-2026-98850
  • net/packet: prevent TX_RING byte count overflow {CVE-2026-98850}
• CVE-2026-98577
  • nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() {CVE-2026-98577}
• CVE-2026-98482
  • nfc: llcp: drop truncated I/RR/RNR PDUs in nfc_llcp_recv_hdlc() {CVE-2026-98482}
• CVE-2026-98576
  • nfc: llcp: fix slab-out-of-bounds reads when logging service names {CVE-2026-98576}
• CVE-2026-98624
  • netfilter: nfnetlink_queue: hold nfnl mutex in event notifier {CVE-2026-98624}
• CVE-2026-98794
  • ipvs: filter some flags received in the backup server {CVE-2026-98794}
• CVE-2026-98698
  • wifi: mac80211: handle empty FILS association request payload {CVE-2026-98698}
• CVE-2026-98526
  • llc: reserve device headroom for allocated frames {CVE-2026-98526}
• CVE-2026-98532
  • ipv6: do not let ipv6_find_hdr() return an offset past the packet end {CVE-2026-98532}
• CVE-2026-98569
  • ip_gre: Reject enabling collect metadata through changelink {CVE-2026-98569}
• CVE-2026-98541
  • fou: reject omitted FOU_ATTR_IPPROTO on FOU_ENCAP_DIRECT {CVE-2026-98541}
• CVE-2026-98573
  • net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() {CVE-2026-98573}
• CVE-2026-98567
  • net: xps: reject an out of range traffic class {CVE-2026-98567}
• CVE-2026-98457
  • Bluetooth: L2CAP: validate frame length before control and FCS access {CVE-2026-98457}
• CVE-2026-98460
  • Bluetooth: hci_sock: reject out-of-range OCF values {CVE-2026-98460}
• CVE-2026-98636
  • squashfs: Add dictionary size range check to prevent shift-out-of-bounds {CVE-2026-98636}
• CVE-2026-98772
  • USB: serial: fix port tear down use-after-free {CVE-2026-98772}
• CVE-2026-98697
  • USB: serial: fix dynamic id driver deregistration race {CVE-2026-98697}
• CVE-2026-98769
  • usb: gadget: f_uac1_legacy: validate bRequest index in generic_{set,get}_cmd {CVE-2026-98769}
• CVE-2026-98764
  • usb: gadget: f_fs: Fix NULL pointer dereference in FUNCTIONFS_ENDPOINT_DESC {CVE-2026-98764}
• CVE-2026-98838
  • vt: skip screen update for DEC alignment test on backgroup consoles {CVE-2026-98838}
• CVE-2026-98578
  • nfc: st21nfca: validate ISO15693 inventory length {CVE-2026-98578}
• CVE-2026-98583
  • nfc: nfcmrvl: validate helper command length before pull {CVE-2026-98583}
• CVE-2026-98612
  • net: usb: catc: bound the RX packet length in catc_rx_done() {CVE-2026-98612}
• CVE-2026-98722
  • mtd: block2mtd: Fix divide error when erase_size is zero {CVE-2026-98722}
• CVE-2026-98657
  • iio: proximity: pulsedlight: fix iio_device left registered on PM setup failure {CVE-2026-98657}
• CVE-2026-98623
  • drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update {CVE-2026-98623}
• CVE-2026-98732
  • Bluetooth: btintel: fix buffer over-read in btintel_hw_error() {CVE-2026-98732}
• CVE-2026-98393
  • net: ipv4: Fix UDP length overflow with PMTU discover and big MTU {CVE-2026-98393}
• CVE-2026-53255
  • Bluetooth:…

In the Linux kernel, the following vulnerability has been resolved:

wifi: mac80211: handle empty FILS association request payload

fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called with an empty plaintext.

kmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the unconditional sg_init_one() puts an invalid page into the scatterlist. With CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf(); without the debug check the bogus page is handed to the crypto backend.

AES-SIV is defined for empty plaintext and the S2V result is then the complete output, so handle this case before the CTR step, which has nothing to encrypt.

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: handle empty FILS association request payload fils_encrypt_assoc_req() accepts a (Re)Association Request frame whose last element is the FILS Session element. crypt_len is then zero and aes_siv_encrypt() is called with an empty plaintext. kmemdup() returns ZERO_SIZE_PTR for a zero-length allocation, so the unconditional sg_init_one() puts an invalid page into the scatterlist. With CONFIG_DEBUG_SG this triggers a kernel BUG in sg_set_buf(); without the debug check the bogus page is handed to the crypto backend. AES-SIV is defined for empty plaintext and the S2V result is then the complete output, so handle this case before the CTR step, which has nothing to encrypt.

The SUSE Linux Enterprise Micro 6.0 and Micro 6.1 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64324: udf: validate free block extents against the partition length (bsc#1273970).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64413: netfilter: ebtables: zero chainstack array (bsc#1274082).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72127: netdev-genl: report NAPI thread PID in the caller's pid namespace (bsc#1277542).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72400: seg6: validate SRH length before reading fixed fields (bsc#1278030).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74399: evm: terminate and bound the evm_xattrs read buffer (bsc#1278319).
• CVE-2026-74565: netfilter: nf_tables: make nft_object rhltable per table (bsc#1275568).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74720: bpf: Preserve pointer state for commuted arithmetic (bsc#1276574).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80684: KVM: s390: pci: Fix NULL dereference on AIBV allocation failure (bsc#1277467).
• CVE-2026-80709: s390/zcrypt: Fix wrong domain value verification with EP11 CPRBs (bsc#1278202).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a…

The SUSE Linux Enterprise 15 SP7 kernel was updated to fix various security issues:

The following security issues were fixed:

• CVE-2025-68219: cifs: fix memory leak in smb3_fs_context_parse_param error path (bsc#1255222).
• CVE-2026-31708: smb: client: fix OOB read in smb2_ioctl_query_info QUERY_INFO path (bsc#1264022).
• CVE-2026-31709: smb: client: validate the whole DACL before rewriting it in cifsacl (bsc#1264024).
• CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits (bsc#1264985).
• CVE-2026-46155: smb/client: fix out-of-bounds read in smb2_compound_op() (bsc#1267720).
• CVE-2026-64370: posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (bsc#1273805).
• CVE-2026-64380: smb: client: harden POSIX SID length parsing (bsc#1273557).
• CVE-2026-64430: NTB: epf: Avoid calling pci_irq_vector() from hardirq context (bsc#1274257).
• CVE-2026-64435: audit: Fix data races of skb_queue_len() readers on audit_queue (bsc#1274080).
• CVE-2026-68186: binfmt_misc: set have_execfd only once the interpreter is opened (bsc#1274949).
• CVE-2026-68436: drm/amd/display: use kvzalloc to allocate struct dc (bsc#1276275).
• CVE-2026-68447: drm/amdkfd: clamp v9 CRIU control stack checkpoint copy to BO size (bsc#1276280).
• CVE-2026-68460: f2fs: fix potential deadlock in f2fs_balance_fs() (bsc#1276774).
• CVE-2026-72010: cgroup/cpuset: rebind mm mempolicy to effective_mems, not mems_allowed (bsc#1276776).
• CVE-2026-72073: mmc: vub300: fix use-after-free on probe failure (bsc#1277157).
• CVE-2026-72110: bpf,fork: wipe ->bpf_storage before bailouts that access it (bsc#1277357).
• CVE-2026-72111: bpf: Reset register bounds before narrowing retval range in check_mem_access() (bsc#1277389).
• CVE-2026-72250: netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag (bsc#1277663).
• CVE-2026-72253: netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (bsc#1277665).
• CVE-2026-72318: cifs: validate DFS referral string offsets (bsc#1275939).
• CVE-2026-72405: net: udp_tunnel: prevent double queueing in udp_tunnel_nic_device_sync (bsc#1278033).
• CVE-2026-72416: netfilter: nft_compat: ebtables emulation must reject non-bridge targets (bsc#1278041).
• CVE-2026-72428: bpf: Fix stack slot index in nospec checks (bsc#1278050).
• CVE-2026-74368: wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic() (bsc#1277103).
• CVE-2026-74472: ublk: reset kernel-owned dev_info fields in ublk_ctrl_add_dev() (bsc#1277785).
• CVE-2026-74613: vsock/virtio: avoid refilling the RX queue after teardown (bsc#1277903).
• CVE-2026-74620: net/sched: act_gact, act_police: range check the fallback control action (bsc#1277044).
• CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock (bsc#1277599).
• CVE-2026-74715: net: netfilter: Make ct zone opts configurable for bpf ct helpers (bsc#1277890).
• CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last (bsc#1278101).
• CVE-2026-74748: netfilter: ipset: fix refcount race between list:set GC and swap (bsc#1277578).
• CVE-2026-80572: Input: byd - synchronize timer deletion before freeing private data (bsc#1277338).
• CVE-2026-80602: perf/x86/amd/lbr: Fix kernel address leakage (bsc#1278123).
• CVE-2026-80637: netfilter: synproxy: fix unaligned memory access in timestamp adjustment (bsc#1278343).
• CVE-2026-80717: sctp: validate Adaptation Indication parameter length (bsc#1277836).
• CVE-2026-80755: selinux: reject a permission value exceeding the class permission count (bsc#1278415).
• CVE-2026-80757: selinux: reject a class permission count below its inherited common (bsc#1278711).
• CVE-2026-80808: ext4: stop retrying saturated xattr cache entries (bsc#1279795).
• CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs (bsc#1279606).
• CVE-2026-80855: fuse: fix invalidate lock leak on open O_TRUNC DAX failure (bsc#1279564).
• CVE-2026-80879: ocfs2: fix circular locking dependency…