Linux Kernel CVEs: What to Patch by Device (25 – 31 Oct 2026)

This is a smaller week than last week, with 129 records, so the list of Linux kernel CVEs is short enough to scan. The records were published on two days: 12 on 26 October and 117 on 28 October. Most are narrow driver or protocol fixes. Use this post to find the records that match your device class, then plan one update from the version table. This post describes 16 of the 129 records and names more. The full list with files and fixed versions is in the weekly report. The count was taken on 31 October, before the window closed, so records published later on 31 October are not included.

The one action: update to the fixed version for your branch

Run uname -r and find your branch in the table. If your version is lower than the value in the second column, plan the update. Each value is the highest fixed version named by any of this week’s records for that branch. On 5.10, 5.15, 6.1, 6.6 and 6.12 the value equals the newest release in the kernel.org release list on 31 October 2026. On 6.18 and 7.2 the newest release is one patch level higher (6.18.60 and 7.2.14), so use the newest release there.

Branches that are not listed were not affected, or the fix was released before this window. A record can list no fix for an older branch where the code may exist. This week 35 records list a fix only for 7.2 and mainline, for example CVE-2026-99164 and CVE-2026-99188. The record does not say whether older branches are exposed, so check your tree. CVE-2026-99103 also names older fix versions (6.6.25 and 6.8.4) beside the current ones, and they do not change the table.

Mobile and automotive

Phones, cars and wearables depend on Bluetooth, Wi-Fi, USB Type-C power handling and vendor SoC (system on chip) drivers. The records below apply to those.

CVE-2026-99215: Power supply core use-after-free on unregister

In drivers/power/supply/power_supply_core.c, a power supply can be unregistered while one of its callbacks is still running. A callback such as external_power_changed(), started by the TCPM (USB Type-C port manager) stack, can then use driver data that is already freed. The record gives an example where the hardware bus fails right after the power supply is registered, so queued callbacks are still running when removal starts. The record gives no score. It matters for battery and charger drivers on USB Type-C devices. The bug exists since 4.1. The record lists a fix only in 6.18.59, 7.2.13 and mainline 7.3. It lists no fix for older branches, so check your tree. See the cve.org record.

CVE-2026-99091: Bluetooth management socket sends a wrong status on power off

When Bluetooth is powered off, pending management commands are flushed. For a command without a completion callback, cmd_complete_rsp() falls through to cmd_status_rsp(), which reads its data as a u8 *. The status that is sent therefore comes from the wrong data. The record gives no score. It applies to any phone, car head unit or wearable that uses the Bluetooth management interface. The record lists fixes in 6.1.191, 6.6.160, 6.12.113, 6.18.57 and 7.2.11, and the table above has the higher versions that clear all records. See the cve.org record.

CVE-2026-99094: Intel PCIe Bluetooth transmit descriptor bounds check

In btintel_pcie_prepare_tx(), the index tfd_index is used to reach the TFD and data buffer arrays before it is advanced modulo txq->count. An index equal to txq->count is one past the end of both arrays. The fix rejects it in the bounds check. The record gives no score. It applies to devices with an Intel Bluetooth controller on PCIe, driver drivers/bluetooth/btintel_pcie.c. The bug exists since 6.10. The fix is in 6.12.113, 6.18.57 and 7.2.11. See the cve.org record.

CVE-2026-99100: Wi-Fi p54 firmware record lengths

The p54 firmware parser reads component ID and component version records without checking that their lengths cover the fields it reads. A malformed record makes the parser read past the end of the record. The input is the firmware file and not a radio frame, so the risk is a damaged or altered firmware image. The record gives no score and no start version. It applies only to devices that use the p54 Wi-Fi driver. A fix is listed for every branch in the table: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13. See the cve.org record.

Embedded and IoT

Embedded boards use many small drivers: GPIO, SPI, Ethernet MACs, trusted execution and low-power radio links. The records below apply only if your kernel builds the named code.

CVE-2026-99134: IEEE 802.15.4 association race and NULL dereference

In the mac802154 code, the pointer local->assoc_dev is shared between the association path and the association-response worker without common synchronization. The timeout and error paths clear the pointer while the worker can still use it. The record also names a second, possibly malicious, response to the same request as one way to hit the problem. The record gives no score. It applies to boards with an IEEE 802.15.4 low-power radio that use the kernel MAC layer. The bug exists since 6.8. The fix is in 6.12.115, 6.18.59 and 7.2.13. See the cve.org record.

CVE-2026-99097: TEE shared memory allocation of size zero

tee_dyn_shm_alloc_helper() takes the page count from a size given by the caller and passes it to alloc_pages_exact() without a check. For size 0 the page count is 0, and alloc_pages_exact(0) calls get_order(0), which the kernel documents as undefined. The fix rejects zero-sized allocations. The record gives no score. It applies to boards that use the kernel TEE (trusted execution environment) shared memory code. The bug exists since 6.10. The fix is in 6.12.113, 6.18.57 and 7.2.11. See the cve.org record.

CVE-2026-99164: spi-imx DMA bounce buffers too small

The spi-imx driver allocates its private DMA transmit and receive buffers with kzalloc(dma_len), where the length is rounded up to only 4 bytes. It maps, syncs and unmaps the buffers with a cache-aligned DMA size. The record title calls the result slab corruption. The record gives no score. It applies to boards that use the ECSPI controller in DMA mode. The bug exists since 7.0. The record lists a fix only in 7.2.13 and mainline 7.3. See the cve.org record.

CVE-2026-99189: gpio-mxc interrupt before probe completes

mxc_update_irq_chained_handler() is called before the IRQ domain, the generic IRQ chip and the port list entry are set up. If an interrupt arrives in that window, mx3_gpio_irq_handler() calls generic_handle_domain_irq() while port->domain is still NULL. The record gives no score. It applies to boards that use the i.MX GPIO driver gpio-mxc with a pending interrupt at boot. The bug exists since 6.6. The fix is in 6.18.59 and 7.2.13. See the cve.org record.

CVE-2026-99188: stmmac RGMII status interrupt is never cleared

A change removed the RGMII interrupt handling from the stmmac driver. Since then nothing on the RGMII path reads GMAC_RGSMIIIS, so the status stays pending behind GMAC_INT_MASK from the first link change on. The record gives no score. It applies to boards with a dwmac1000 Ethernet MAC on an RGMII link. The bug exists since 6.19. The record lists a fix only in 7.2.13 and mainline 7.3. See the cve.org record.

A group of eight Ethernet driver records, CVE-2026-99193 to CVE-2026-99200, fix a probe-time crash. These drivers connect the PHY before they set netdev_ops, and the record text says the probe crashes with a NULL pointer dereference when CONFIG_NET_SHAPER is enabled. They affect the drivers for icssm-prueth, aeroflex greth, ethoc, au1000, mv643xx, owl-emac, hip04 and hisi_femac. The bug exists since 7.2 and each record lists a fix only in 7.2.13 and mainline 7.3.

Cloud and datacenter

Servers and container hosts care most about the network stack, file systems, virtualization and the core kernel. The records below are the ones to read first.

CVE-2026-99128: SCTP chunk length is not validated in the input queue parser

sctp_inq_pop() accepts declared chunk lengths shorter than the 4-byte generic chunk header. A zero-length chunk leaves chunk_end at the current header. The record says a remote SCTP peer can trigger this after it establishes an association, on a kernel built with CONFIG_IP_SCTP and configured with net.sctp.addip_enable=1 and net.sctp.auth_enable=1. The reproducer did not need application credentials, a shared SCTP-AUTH key or net.sctp.addip_noauth_enable=1. The record gives no score. This is the record in this edition with the clearest remote reach. The bug exists since 2.6.24. A fix is listed for every branch in the table. See the cve.org record.

CVE-2026-99138: TCP_CC_INFO getsockopt use-after-free

do_tcp_getsockopt() reads icsk->icsk_ca_ops and calls the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, the ops can point to dynamically allocated memory that is freed at the same time. The record gives no score. It applies to hosts that load BPF struct_ops TCP congestion control. The bug exists since 5.6. A fix is listed for every branch in the table. The related record CVE-2026-99139 fixes the same pattern for the TCP_CONGESTION option and lists fixes from 6.1.191 up. See the cve.org record.

CVE-2026-99130: io_uring cancel loop spins on work the task cannot run

io_uring_cancel_generic() refuses to sleep while any ring on the exiting task has local work pending. It assumes the task is the submitter of that ring and that the next cancel pass will run the work. The record says this does not hold for some rings, and that an unprivileged user can set this up. The record gives no score. It applies to hosts that allow io_uring to unprivileged users. The bug exists since 6.4. The fix is in 6.6.161, 6.12.115, 6.18.59 and 7.2.13. See the cve.org record.

CVE-2026-99176: KVM nested VMX does not restore the root MMU after a failed load

On Intel hosts, if loading L2 state fails outside a VM entry, KVM does not reset the vCPU MMU pointer to the root MMU. The two cases named are emulating RSM and handling KVM_SET_NESTED_STATE. KVM then tries to run L1 with a nested MMU. The record gives no score. It applies to Intel hosts that run nested guests. The bug exists since 4.15. A fix is listed for every branch in the table. A separate record, CVE-2026-99177, fixes page dirtying for SEV guests and lists a fix only in 7.2.13. See the cve.org record.

CVE-2026-99123: vsock virtio accepts packets that do not match the peer

virtio_transport_recv_pkt() looks up a socket first by the full source and destination, then by destination only in the bound table. Sockets stay in the bound table after connect(), so the second lookup can pick a connected socket. The fix validates the packet source for connected sockets. The record gives no score. It applies to virtual machine hosts and guests that use virtio vsock. The bug exists since 4.8. The fix is in 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13. The VMCI transport has a matching record, CVE-2026-99122, fixed in 6.18.59 and 7.2.13. See the cve.org record.

CVE-2026-99110: CIFS client heap overflow when setting an ACL

cifs_set_acl() checks the ACL size with posix_acl_xattr_size(), which is 4 bytes plus 8 per entry. Then cifs_do_set_acl() writes the CIFS wire format into the same buffer, which is 6 bytes plus 10 per entry. The wire format is larger, so the write can pass the end of the buffer. The record gives no score. It applies to hosts that mount SMB shares with the in-kernel CIFS client and set POSIX ACLs on them. The bug exists since 6.2. The fix is in 6.6.161, 6.12.115, 6.18.59 and 7.2.13. See the cve.org record.

CVE-2026-99152: libiscsi trusts a task index named by the target

__iscsi_complete_pdu() fetches the task for five response types from one place. It checks only that the index resolved. The record says a target can name any slot in the pool. The record gives no score. It applies to hosts that attach to iSCSI storage as an initiator. Two sibling records, CVE-2026-99153 and CVE-2026-99154, fix the Reject PDU tag and a negative task index in the same file. The bug exists since 2.6.18. A fix is listed for every branch in the table. See the cve.org record.

Medical devices

Connected clinical devices use Bluetooth, Wi-Fi, USB and network file shares. These records apply when the device uses the same code. For devices with Bluetooth links, check CVE-2026-99091 and CVE-2026-99094. For devices with p54 Wi-Fi hardware, check CVE-2026-99100. For devices that mount SMB shares for clinical data, check CVE-2026-99110. For devices that accept SCTP connections, check CVE-2026-99128.

Medical-device patching depends on validation and regulatory revalidation (US FDA postmarket cybersecurity guidance, EU MDR, IEC 62304). The action is to plan the stable update through the manufacturer’s change-control process. Do not delay it without a documented risk assessment, and use compensating controls such as network segmentation and disabling unused services in the meantime.

How to check if these Linux kernel CVEs apply to you

Ask three questions. First: which version do you run? Second: is the related code enabled? Third: can an attacker reach it?

Version: run uname -r and compare it with the table. The example output below is only an illustration. Your value will differ.

raghu@techveda.org:~$ uname -r
6.6.150

Features: check whether the modules from the sections above are loaded or built in. If nothing matches, the code is not in use. The search below is an example. Replace the names with the drivers on your device.

raghu@techveda.org:~$ lsmod | grep -i -E 'sctp|btintel|cifs|p54|802154'
raghu@techveda.org:~$ zcat /proc/config.gz | grep -i -E 'sctp|bluetooth|cifs|802154|spi_imx'

Reachability decides which bugs to fix first. Fix remote or over-the-air bugs first. Fix local unprivileged bugs next. Fix guest-to-host bugs on shared hosts after that. Fix privileged or configuration-only bugs last. Because no record has a score this week, use this order for all of them.

Key takeaways

• The kernel CNA published 129 CVEs for 25 to 31 October 2026, counted on 31 October. None has a CNA score.
• Minimum safe versions: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13. On 6.18 and 7.2 use the newest release (6.18.60, 7.2.14).
• CVE-2026-99128 is the record with the clearest remote reach: a remote SCTP peer on a kernel built with CONFIG_IP_SCTP.
• 35 records list a fix only for 7.2 and mainline. Check older branches in your tree.
• This post does not assess whether any bug is being exploited. Check your own exposure with the steps above.

Frequently asked questions

How many Linux kernel CVEs were published from 25 to 31 October 2026?
The kernel CNA published 129 records in this window, according to NVD, counted on 31 October before the window closed. None carries a CNA score.

Why are there no CRITICAL or HIGH Linux kernel CVEs this week?
Because no record has a CNA score, so none is rated. A missing score does not mean low risk. Rank the records by whether an attacker can reach the code on your device.

I applied last week’s minimum safe versions. Is that enough?
No. Last week’s versions were 5.10.271, 5.15.222, 6.1.189, 6.6.160, 6.12.114, 6.18.58 and 7.2.12. This week’s values are higher on every branch: 5.10.273, 5.15.224, 6.1.191, 6.6.161, 6.12.115, 6.18.59 and 7.2.13.

Which record has the clearest remote reach?
CVE-2026-99128, an SCTP input parser bug. The record says a remote SCTP peer can trigger it after it establishes an association, on a kernel built with CONFIG_IP_SCTP and with net.sctp.addip_enable=1 and net.sctp.auth_enable=1.

Does mainline 7.3 include these fixes?
Mainline 7.3 was released on 18 October 2026, and stable 7.3.1 on 30 October 2026. Records that list a mainline fix name 7.3. Check the record if you run a different mainline version.

Further reading

• CVE-2026-99128 on cve.org
• CVE-2026-99138 on cve.org
• linux-cve-announce mailing list archive
• kernel.org releases
• Linux kernel CVE process documentation
• TECH VEDA kernel CVE tracker
• Previous edition: Linux Kernel CVEs, 18 – 24 Oct 2026