Linux Kernel CVEs: What to Patch by Device (11 – 17 Oct 2026)

This week has 49 records. Last week had 220. This is a low-volume week, but it is not a quiet week for the network stack. The CRITICAL record and a TCP use-after-free record (CVE-2026-98432) are both in IPv4 code that almost every product uses. This post describes 14 of the records and names more. Most of the other records are narrow driver and architecture fixes, so which ones matter depends on what your product uses. Use this post to find the Linux kernel CVEs that apply to your device class, then use the version table to plan one update.

The one action: update to the fixed version for your branch

Run uname -r and find your branch in the table. If your version is lower than the value in the second column, plan the update. Each value is the highest fixed version named by any of this week’s records for that branch, so one update covers every record that lists a fix for that branch. Each value equals the newest release on its branch in the kernel.org release list on 17 October 2026.

Branches that are not listed were not affected, or the fix was released before this window. Check the record for your branch. A record can list no fix for an older branch where the bug may exist. The record does not say whether that branch is exposed, so check your tree and consider a newer longterm branch. 9 records name a stable fix only for 7.2. Six of them are in code introduced in 6.19, 7.1 or 7.2, so older branches do not have the code: CVE-2026-98385, CVE-2026-98391, CVE-2026-98395, CVE-2026-98396, CVE-2026-98397 and CVE-2026-98418. The other three are older bugs: CVE-2026-98420 (ksmbd), CVE-2026-98427 (CoDel) and CVE-2026-98431 (RDMA uverbs). They list no fix for 6.18 or earlier stable branches. CVE-2026-98393 (IPv4 UDP) also lists a fix only for 6.18 and 7.2, although the bug dates from 3.13. The kernel.org list of maintained releases no longer includes 7.1, so a 7.1 kernel should move to 7.2.

Mobile and automotive

Phones and vehicle units use SELinux, Bluetooth, local sockets and SoC drivers. None of the records in this section has a CNA score. They are local or device-side issues, not over-the-air issues. The network records in the cloud section also apply to any phone or vehicle unit that runs an IPv4 stack.

CVE-2026-98413: SELinux access decision left uninitialized

The CNA has not scored this record. avc_has_perm_noaudit() is documented to return a copy of the access decision, but it returns early when the requested permission set is empty and leaves the output buffer untouched. All callers pass an uninitialized stack variable and then give it to avc_audit(). The inode hook also stores it in the per-task decision cache. The fix fills in a deny-all, audit-all decision. The record gives no attack path. The effect is that a stack value that was never set is used in an access-control audit path and cache. This matters for products that rely on SELinux, which includes Android-based devices. The code is in security/selinux/avc.c. It affects 5.1 and later. The fix is in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8. See the cve.org record.

CVE-2026-98392: Bluetooth Intel PCIe transmit completion off-by-one

The CNA has not scored this record. In btintel_pcie_msix_tx_handle() the guard used > txq->count where it needed >= txq->count. An index equal to the queue size passed the check and was then used as an index into txq->urbd0s, tfds and bufs, one entry past the end. The code is in drivers/bluetooth/btintel_pcie.c, the driver for Intel Bluetooth controllers that connect over PCIe. The record does not say who controls the index. It affects 6.10 and later. The fix is in 6.12.111, 6.18.53 and 7.2.7. Branches 5.10 to 6.6 do not have this code. See the cve.org record.

CVE-2026-98394: AF_UNIX receive loop with MSG_PEEK

The CNA has not scored this record. A blocking recv() with a zero-length buffer and MSG_PEEK loops without sleeping when the last queued message is an out-of-band (MSG_OOB) message. TCP returns 0 at once in the same case, and the fix makes AF_UNIX do the same. A local program can keep one CPU busy this way. It matters where untrusted programs can run, because local sockets are used by many system services. The code is in net/unix/af_unix.c. It affects 5.15 and later. The fix is in 6.12.111, 6.18.53 and 7.2.7. The record lists no fix for 5.15, 6.1 and 6.6. See the cve.org record.

CVE-2026-98415: Samsung Exynos PMU use-after-free of a device-tree node

The CNA has not scored this record. setup_cpuhp_and_cpuidle() releases its reference to the interrupt generator node with of_node_put() and then passes the same pointer to of_syscon_register_regmap(). The fix declares the pointer with __free() and removes the early release. This runs at driver setup on Samsung Exynos SoCs, and the record describes no network path. The code is in drivers/soc/samsung/exynos-pmu.c. It affects 6.18 and later. The fix is in 6.18.54 and 7.2.8. See the cve.org record.

Also check CVE-2026-98414 (not scored). A cgroup memory charge can reach the root memory cgroup through zswap, which gives a kernel warning and a leaked charge. It affects 6.15 and later and is fixed in 6.18.54 and 7.2.8. The Wi-Fi records CVE-2026-98406, CVE-2026-98421, CVE-2026-98422, CVE-2026-98423, CVE-2026-98424 and CVE-2026-98425 fix kernel warnings in mac80211 and cfg80211. None of them is scored, and the records describe warnings, not memory corruption.

Embedded and IoT

Embedded boards use small SoC drivers and low-cost wireless parts. Check the driver names against your board configuration before you set the priority. This week’s embedded records are mostly crash and reliability fixes, with one memory write in a Wi-Fi driver.

CVE-2026-98407: RSI Wi-Fi heap out-of-bounds write on key removal

The CNA has not scored this record. When a key is removed, rsi_hal_load_key() writes zeros with memset(&set_key[FRAME_DESC_SZ], ...). Because set_key is a pointer to a 160-byte structure, the index is scaled by that size. The write starts about 2.4 KB past the end of the 160-byte buffer and writes 144 bytes. The record says this happens on every key removal, so disconnects, roams and interface teardown trigger it on real networks. The written bytes are zeros. The fix removes the memset, because the buffer is already zeroed. The code is in drivers/net/wireless/rsi/rsi_91x_mgmt.c, the RSI 91x Wi-Fi driver. It affects 3.15 and later. The fix is in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8. See the cve.org record.

CVE-2026-98410: DA9063 watchdog keeps running during suspend

The CNA has not scored this record. The driver leaves the watchdog running and sets WDOG_HW_RUNNING at probe. If user space never opens the device, WDOG_ACTIVE stays clear, so the suspend callback does nothing and the watchdog keeps counting during system suspend. This leads to an unexpected system reset. It is an availability and reliability bug, not a security boundary bug. The code is in drivers/watchdog/da9063_wdt.c. It affects 5.19 and later. The fix is in 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8. See the cve.org record.

CVE-2026-98408: Renesas RZ/V2H watchdog division by zero

The CNA has not scored this record. If clk_get_rate() returns 0, the driver divides by zero and the kernel panics. The record gives no way for an outside party to make the clock rate 0. The same fix pattern appears in CVE-2026-98409 for the rtd119x watchdog, which affects 4.16 and later and is fixed in 6.6.158, 6.12.112, 6.18.54 and 7.2.8. The code for this record is in drivers/watchdog/rzv2h_wdt.c. It affects 6.12 and later. The fix is in 6.18.54 and 7.2.8. The record lists no 6.12 fix. See the cve.org record.

CVE-2026-98416: TI K3 UDMA NULL dereference in an error path

The CNA has not scored this record. If devm_kcalloc() fails for rx_chn->flows, the error path calls k3_udma_glue_release_rx_chn(), which dereferences the NULL pointer. The record says it was found by the Linux Verification Center with SVACE, a static analysis tool. The trigger is an allocation failure. The code is in drivers/dma/ti/k3-udma-glue.c. It affects 5.6 and later. The fix is in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8. See the cve.org record.

Also check CVE-2026-98411 and CVE-2026-98412 (not scored). Both are NULL dereferences in the power sequencing core that follow a failed allocation or a failed name setup. They affect 6.11 and later and are fixed in 6.12.112, 6.18.54 and 7.2.8. CVE-2026-98397 (not scored) fixes a missing device reference in the x86 Android tablet support code. It exists only in 7.2 and is fixed in 7.2.7.

Cloud and datacenter

The CRITICAL record and the TCP record are here. Both are in the IPv4 stack, so also read them if your device is not a server. This section also covers SMB records, a drop-monitor memory write and a queueing discipline lock-up.

CVE-2026-99999: IPv4 checksum_start validation (CRITICAL 9.3)

The CNA scores this 9.3 CRITICAL (CVSS 3.1, vector AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H): local, no privileges, no user interaction, changed scope. The record says that if a packet with bad checksum metadata gets into the IPv4 stack, skb_checksum_help() can corrupt the network header. The fix checks checksum_start before the checksum is completed. The record calls this a defense-in-depth measure and says that a more complete validation at packet input is forthcoming, so expect a follow-up record. The changed files are in net/ipv4/ip_output.c, net/bridge/netfilter/nf_conntrack_bridge.c, net/netfilter/nfnetlink_queue.c, net/netfilter/xt_CHECKSUM.c and net/xfrm/xfrm_output.c, so bridged, queued and IPsec traffic paths are involved. The record’s CISA entry (16 October) lists exploitation as none, automatable as no and technical impact as total. The record links public write-ups. It affects 2.6.27 and later. The fix is in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11. This record sets the table value on every branch. See the cve.org record.

CVE-2026-98432: IPv4 option memory freed too early (TCP)

The CNA has not scored this record. tcp_v4_syn_recv_sock() passes ownership of ireq->ireq_opt to the child socket. Another CPU can handle a retransmitted SYN for the same request socket and read those options while the child socket is freed with a plain kfree(). ip_options_build() then reads freed memory. A second path exists with request socket migration (net.ipv4.tcp_migrate_req=1 or a BPF reuseport migrate program). The fix uses kfree_rcu(). This is memory corruption in the TCP listen path, so it relates to any device that accepts IPv4 TCP connections. The record does not say how likely the race is. The code is in net/ipv4/af_inet.c and net/ipv4/tcp_ipv4.c. It affects 4.4 and later. The fix is in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98419: drop_monitor out-of-bounds write

The CNA has not scored this record. In reset_per_cpu_data() the buffer size includes the 4-byte netlink attribute header, but the memset starts after that header. The write goes 4 bytes past the allocation and corrupts skb_shared_info. The fix allocates with nla_total_size() and zeroes only the payload length. The record does not say which privileges are needed to reach this code. The code is in net/core/drop_monitor.c. It affects 2.6.31 and later. The fix is in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.54 and 7.2.8. See the cve.org record.

CVE-2026-98427: CoDel dropping loop can lock up the CPU

The CNA has not scored this record. For a very small CoDel interval the next-drop step rounds down to zero. The loop in codel_dequeue() then drops the whole backlog while it holds the qdisc lock. The record says an unprivileged user can trigger a soft lockup this way. Its example sets up the qdisc with tc, so the qdisc must be configured with a tiny interval. The fix makes the step at least 1 tick and limits the loop to 256 drops per call. It applies to both codel and fq_codel. The code is in include/net/codel.h and include/net/codel_impl.h. It affects 3.5 and later. The record names a fix only for 7.2 (7.2.8) and mainline. See the cve.org record.

CVE-2026-98420: ksmbd session expiration

The CNA has not scored this record. The ksmbd server removed valid sessions after ten seconds of inactivity when a client began another session setup. This broke mapped drives for Windows clients. The fix follows the SMB2 session expiration rules and allows one in-progress authentication per connection, which keeps the protection against abandoned unauthenticated exchanges. The record names the original unauthenticated memory-exhaustion path as bounded by the new limit. The code is in fs/smb/server/. It affects 6.4 and later, with older stable backports listed from 5.15.145. The record names a fix only for 7.2 (7.2.8) and mainline. See the cve.org record.

CVE-2026-98405: SMB client out-of-bounds read in parse_posix_sids()

The CNA has not scored this record. The end of the SID buffer is computed from the length that the server supplies, without a check against the received data. A server that sends an inflated length defeats the later bounds checks, and the client reads adjacent kernel memory. A client that mounts a share from an untrusted server is exposed. The code is in fs/smb/client/smb2inode.c. It affects 6.6.32 and later. The fix is in 6.6.158, 6.12.112, 6.18.54 and 7.2.8. See the cve.org record.

Also check these records. CVE-2026-98401 (not scored) fixes a crash when a decapsulated tunnel frame is forwarded by a bridge or HSR with a stale transport header. It is fixed in 6.12.111, 6.18.53 and 7.2.7. CVE-2026-98417 (not scored) rejects ESP-in-TCP transport header offsets that do not fit, and it is fixed on all branches in the table. CVE-2026-98431 (not scored) is a deadlock in RDMA uverbs and is fixed only in 7.2.8. CVE-2026-98429 and CVE-2026-98430 (not scored) fix lifetime problems in the Amazon EFA RDMA driver. CVE-2026-98390 (not scored) fixes a divide by zero on a Xen PVH dom0. CVE-2026-98404 (not scored) fixes a NULL dereference in the virtio GPU driver and is fixed on all branches in the table.

Medical devices

Connected clinical devices use TCP/IP, Wi-Fi, Bluetooth, USB and network file shares. For any device with an IPv4 stack, such as devices that exchange DICOM or HL7 messages, check CVE-2026-99999 and CVE-2026-98432 first. For devices with a Wi-Fi module that uses the RSI 91x driver, check CVE-2026-98407. For devices with an Intel Bluetooth controller on PCIe, check CVE-2026-98392. A device that only mounts an SMB share with the kernel client is in scope for CVE-2026-98405, even if it never acts as a server. Most medical devices do not use the ksmbd server, RDMA or the other server-side records in this batch.

Medical-device patching depends on validation and regulatory revalidation (US FDA postmarket cybersecurity guidance, EU MDR, IEC 62304). The action is to plan the stable update through the manufacturer’s change-control process. Do not delay it without a documented risk assessment, and use compensating controls such as network segmentation and disabling unused services in the meantime.

How to check if these Linux kernel CVEs apply to you

Ask three questions. First: which version do you run? Second: is the driver or feature built into your kernel? Third: can an attacker reach the code?

Version: run uname -r and compare it with the table. The example output below is only an illustration. Your values will differ.

raghu@techveda.org:~$ uname -r
6.6.150

Configuration: each CVE section names the source file. Find the build symbol in the Makefile of that directory, then look for the symbol in the configuration of your running kernel. The commands below show the method with the RSI driver as an example. Replace the path and the symbol for the record you are checking.

raghu@techveda.org:~$ grep -n rsi_91x linux/drivers/net/wireless/rsi/Makefile
raghu@techveda.org:~$ zcat /proc/config.gz | grep CONFIG_<SYMBOL>

If the symbol is not set, the code is not built. A module must also be loaded before its code runs. Some records also need a debug option to show the warning. For example, CVE-2026-98402 describes a warning that appears when CONFIG_DEBUG_NET=y.

Reachability decides which bugs to fix first. Fix remote or over-the-air bugs first. Fix local unprivileged bugs next. Fix guest-to-host bugs on shared hosts after that. Fix privileged or configuration-only bugs last. For the 48 records with no CNA score, use the same reachability order.

Key takeaways

• The kernel CNA published 49 CVEs for 11 to 17 October 2026. 1 is CRITICAL, 0 are HIGH and 48 have no CNA score.
• The CRITICAL record is CVE-2026-99999 (IPv4 checksum_start, score 9.3, local vector). It is a defense-in-depth fix, and the record says a more complete check at packet input is still to come.
• Minimum safe versions: 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11.
• The TCP record CVE-2026-98432 and the CRITICAL record set the table value on every branch. Update again even if you applied last week’s versions.
• No record states that a bug is being exploited. 9 records name a stable fix only for 7.2, so check the record for your branch.

Frequently asked questions

How many Linux kernel CVEs were published from 11 to 17 October 2026?
The kernel CNA published 49 records in this window, according to NVD, and 49 new CVE announcements appear on the linux-cve-announce list on lore.kernel.org for the same dates. 1 is CRITICAL and 48 have no CNA score. The IDs run without gaps from CVE-2026-98385 to CVE-2026-98432, plus CVE-2026-99999.

Which Linux kernel CVE is CRITICAL this week?
CVE-2026-99999, with a CNA score of 9.3. It is a check in the IPv4 stack for bad checksum metadata. The CNA vector is local with no privileges needed. It is fixed in 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11.

Do the records say these bugs are being exploited?
No record states that a bug is being exploited. The CISA entry in the CVE-2026-99999 record lists exploitation as none on 16 October. The record does link public write-ups, so plan the stable update soon.

I applied last week’s minimum safe versions. Is that enough?
No. Last week’s versions were 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9. This week’s CRITICAL and TCP records need 5.10.272, 5.15.223, 6.1.190, 6.6.159, 6.12.113, 6.18.57 and 7.2.11, so update again.

Does the CVE-2026-99999 fix finish the work?
The record calls it a defense-in-depth check and says a more complete validation at packet input is forthcoming. Expect a follow-up record, and watch the linux-cve-announce list.

Further reading

• CVE-2026-99999 on cve.org
• CVE-2026-98432 on cve.org
• linux-cve-announce mailing list archive
• kernel.org releases
• Linux kernel CVE process documentation
• TECH VEDA kernel CVE tracker
• Previous edition: Linux Kernel CVEs, 4 – 10 Oct 2026