Linux Kernel CVEs: What to Patch by Device (18 – 24 Oct 2026)

This is a high-volume week with 656 records, so the list of Linux kernel CVEs is long and no score helps you sort it. Most are narrow driver or protocol fixes. Use this post to find the records that match your device class, then plan one update from the version table. This post describes 16 of the 656 records and names more. The full list with files and fixed versions is in the weekly report.

The one action: update to the fixed version for your branch

Run uname -r and find your branch in the table. If your version is lower than the value in the second column, plan the update. Each value is the highest fixed version named by any of this week’s records for that branch. On 6.6, 6.12, 6.18 and 7.2 the value equals the newest release in the kernel.org release list on 24 October 2026. On 5.10, 5.15 and 6.1 the newest release is one patch level higher, so use the newest release there.

Branches that are not listed were not affected, or the fix was released before this window. A record can list no fix for an older branch where the code may exist. For example, CVE-2026-98788, CVE-2026-99042 and CVE-2026-98776 list a fix only for 7.2 and mainline. The record does not say whether older branches are exposed, so check your tree. One out-of-sequence record, CVE-2023-7356 (published 21 October), lists older fix versions (6.1.178 and 6.6.145) and does not change the table.

Mobile and automotive

Phones, cars and wearables depend on Bluetooth, CAN, Android binder and vendor SoC (system on chip) drivers. The records below apply to those. This week also has many Wi-Fi fixes (33 records in our grouping), for example CVE-2026-98699 (mesh fast transmit path use-after-free) and CVE-2026-98829 (oversized fragments). Treat them as part of the same update. The binder records CVE-2026-98777 and CVE-2026-98778 are title-only mentions here; read the records if you ship Android.

CVE-2026-98600: Bluetooth RFCOMM short-frame handling

The record gives no score. A 4-byte RFCOMM frame with the extended-length bit cleared passes the first length check. After the check byte is trimmed, skb_pull() fails because the frame is too short, and its return value is ignored. The leftover header is then handled as payload or as a multiplexer command on DLCI 0. RFCOMM is the serial-port layer used by Bluetooth hands-free and serial links, and the frame arrives over the radio link. The fix is in 6.12.112, 6.18.55 and 7.2.9. The record’s version data is inconsistent about where the bug starts, so check your branch. See the cve.org record.

CVE-2026-98758: USB Type-C UCSI over PMIC GLINK use-after-free on removal

In drivers/usb/typec/ucsi/ucsi_glink.c, the PMIC GLINK client is released after the remove function returns, so notification callbacks can still queue work. That work then touches the connector array that ucsi_unregister() already freed, or registers and unregisters the instance a second time. The record gives no score. It applies to kernels that build this driver and that unbind or remove it. The bug exists since 6.4. The fix is in 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98776: binderfs use-after-free write

After binderfs_binder_device_create() publishes the new device entry and releases the directory lock, a concurrent unlinkat() can remove the entry and free the device, and binder_add_device() then writes to freed memory. The record includes a KASAN report from syzkaller. It matters for Android-based devices that use binderfs. The record lists the bug as present from 6.19, and a fix only in 7.2.10 and mainline 7.3. See the cve.org record.

CVE-2026-99066: CAN receive path can panic the machine

A change removed the header resets from init_can_skb(), so received CAN frames again carry mac_header = 0xFFFF. When such a frame reaches packet_rcv_spkt() (the SOCK_PACKET path), the push-length calculation overflows and the kernel stops with an skb_under_panic. The record gives no score. It is an availability bug for vehicles and industrial CAN gateways that also use packet sockets. The record lists it as present from 7.0 and fixed in 7.2.11 and mainline 7.3. See the cve.org record.

Embedded and IoT

Embedded boards use many small drivers: GPIO, RTC, MTD flash, USB gadget mode, device-tree overlays and read-only root file systems. The records below apply only if your kernel builds the named code. IIO sensor and ADC drivers are another large group this week (26 records in our grouping); search the report for your sensor driver name.

CVE-2026-98636: SquashFS XZ dictionary size of zero

When an abnormal SquashFS image has the compression-options flag set but a dictionary size of 0, squashfs_xz_comp_opts() computes a shift exponent of -1 and hits a shift-out-of-bounds. The record gives no score. It matters for devices that mount a SquashFS root file system or update image, because the input is the image itself. The bug exists since 2.6.39. The fix is in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9. See the cve.org record.

CVE-2026-98764: FunctionFS endpoint descriptor NULL dereference

If user space gives FunctionFS only full-speed descriptors and the gadget runs at high speed or super speed, the FUNCTIONFS_ENDPOINT_DESC ioctl selects a descriptor that is NULL and the kernel panics. This applies to embedded devices that act as a USB device and use FunctionFS. The bug exists since 3.18. The fix is in 6.6.160, 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98528: GPIO character device stack leak

In gpio_desc_to_lineinfo(), if acquiring the chip guard fails, the function returns before the info structure is zeroed, and lineinfo_get_v1() can copy kernel stack contents to user space. The record gives no score. The bug exists since 6.9. The fix is in 6.12.112, 6.18.55 and 7.2.9. See the cve.org record.

CVE-2026-98935: RTC wake alarm read leaks stack bytes

struct rtc_wkalrm has padding after the pending member. The RTC_WKALRM_RD ioctl can return the uninitialized bytes in that padding. The fix zero-initializes the structure. It is a small information leak that applies to any board with an RTC. The bug exists since 5.0. The fix is in 6.6.160, 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98722: block2mtd divide error

The erase size comes from the block2mtd module parameter and can be 0. Then add_device() divides by zero. Writing the parameter needs privileges, so this is an availability bug for boards that load this module. The bug exists since 3.15. The fix is in 6.6.160, 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98831: Device-tree overlay reference leak

When overlay changeset initialization fails part-way, the references taken for the fragments already set up are never dropped, because the cleanup loop uses a count that is still 0. It is a reference leak in drivers/of/overlay.c. It matters for boards that apply overlays at run time. The bug exists since 4.15. The fix is in 6.6.160, 6.12.113, 6.18.56 and 7.2.10. Two more overlay records are in the same file: CVE-2026-98854 and CVE-2026-98855. See the cve.org record.

Cloud and datacenter

Servers and container hosts care most about the network stack, file systems, mount namespaces, virtualization and the core kernel. This is the largest group: networking has 157 records and file systems 71 in our grouping. The records below are the ones to read first.

CVE-2026-99083: ksmbd heap out-of-bounds write in Kerberos authentication

The record gives no score. When SMB2_SESSION_SETUP is the second or later request in a compounded SMB2 request, krb5_authenticate() leaves out the offset of earlier responses. It overstates the free space, the length check passes, and memcpy() writes the AP-REP blob past the end of response_buf into kernel heap memory. This applies to hosts that run the ksmbd in-kernel SMB server. It is the record that needs the highest versions on four branches: 6.6.160, 6.12.114, 6.18.58 and 7.2.12. Two more ksmbd records are CVE-2026-98897 and CVE-2026-98901. See the cve.org record.

CVE-2026-98805: TIPC AES-GCM nonce reuse

With per-node transmit keys, the GCM nonce counter lives in the peer’s receive object and is reset when the peer reports a key change. The sender can keep the same key, so nonces repeat. The record says this breaks confidentiality, exposes the GCM authentication key and makes forgeries trivial. It applies to clusters that use TIPC with encryption. The bug exists since 5.5. The fix is in 6.6.160, 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98981: Mount namespace race that can uncover hidden files

Between detach_mounts() and d_delete() a dentry stays hashed and positive, so a lookup can find a file that a mount in another namespace had covered. The fix removes the dentry from the hash first. This record is one of 21 related mount and namespace records, CVE-2026-98976 to CVE-2026-98996, that cover mount locking, automounts, overmounts and pivot_root(). Container hosts that share file systems between namespaces should treat the group as one update. The bug exists since 3.18. This record is fixed in 6.6.160, 6.12.114, 6.18.57 and 7.2.11; other records in the group name different versions, so rely on the table. See the cve.org record.

CVE-2026-98858: io_uring SQPOLL task work use-after-free

With SQPOLL, the polling thread can complete a request as soon as it is published. If that was the last request holding the ring, the ring exit code frees the context while io_req_normal_work_add() still reads it. KASAN reports reads and writes of freed memory. The record gives no score. The bug exists since 6.9. The fix is in 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

CVE-2026-98788: futex private hash use-after-free on resize

__futex_pivot_hash() sets mmph->batches before it replaces the hash pointer. If a grace period starts between the two steps, futex_ref_drop() can proceed while a reader still holds the old hash. The bug exists since 6.17. The record names a fix only in 7.2.10 and mainline 7.3. See the cve.org record.

CVE-2026-98716: KVM on AMD checks the wrong MSR bitmap

The MSR intercept check assumed that the vmcb02 bitmap is always in use while L2 is active, but KVM uses it only when L1 wants to intercept MSR accesses. The fix uses the bitmap of the active VMCB. It applies to AMD hosts that run nested guests. The bug exists since 4.16. The fix is in 6.6.160, 6.12.113, 6.18.56 and 7.2.10. See the cve.org record.

Medical devices

Connected clinical devices use Bluetooth, Wi-Fi, USB and read-only root file systems. These records apply when the device uses the same code. For devices with Bluetooth links, check CVE-2026-98600. For devices that mount SquashFS images, check CVE-2026-98636. For devices that act as a USB device, check CVE-2026-98764. For devices that run a file server, check CVE-2026-99083.

Medical-device patching depends on validation and regulatory revalidation (US FDA postmarket cybersecurity guidance, EU MDR, IEC 62304). The action is to plan the stable update through the manufacturer’s change-control process. Do not delay it without a documented risk assessment, and use compensating controls such as network segmentation and disabling unused services in the meantime.

How to check if these Linux kernel CVEs apply to you

Ask three questions. First: which version do you run? Second: is the related code enabled? Third: can an attacker reach it?

Version: run uname -r and compare it with the table. The example output below is only an illustration. Your value will differ.

raghu@techveda.org:~$ uname -r
6.6.150

Features: check whether the modules from the sections above are loaded or built in. If nothing matches, the code is not in use. The search below is an example. Replace the names with the drivers on your device.

raghu@techveda.org:~$ lsmod | grep -i -E 'ksmbd|rfcomm|tipc|squashfs|binder'
raghu@techveda.org:~$ zcat /proc/config.gz | grep -i -E 'ksmbd|rfcomm|tipc|squashfs|binder'

Reachability decides which bugs to fix first. Fix remote or over-the-air bugs first. Fix local unprivileged bugs next. Fix guest-to-host bugs on shared hosts after that. Fix privileged or configuration-only bugs last. Because no record has a score this week, use this order for all of them.

Key takeaways

• The kernel CNA published 656 CVEs for 18 to 24 October 2026: 655 live and 1 rejected. None has a CNA score.
• Minimum safe versions: 5.10.271, 5.15.222, 6.1.189, 6.6.160, 6.12.114, 6.18.58 and 7.2.12. On 5.10, 5.15 and 6.1 use the newest release (5.10.272, 5.15.223, 6.1.190).
• CVE-2026-99083 needs the highest versions on 6.6, 6.12, 6.18 and 7.2. It affects hosts that run ksmbd.
• 21 records, CVE-2026-98976 to CVE-2026-98996, fix mount and namespace races. Container hosts should apply them together.
• This post does not assess whether any bug is being exploited. Check your own exposure with the steps above.

Frequently asked questions

How many Linux kernel CVEs were published from 18 to 24 October 2026?
The kernel CNA published 656 records in this window, according to NVD: 655 live records and 1 rejected record. None carries a CNA score.

Why are there no CRITICAL or HIGH Linux kernel CVEs this week?
Because no record has a CNA score, so none is rated. A missing score does not mean low risk. Rank the records by whether an attacker can reach the code on your device.

I applied last week’s minimum safe versions. Is that enough?
Only on 5.10, 5.15 and 6.1. Last week’s versions there (5.10.272, 5.15.223 and 6.1.190) are higher than this week’s records need. On 6.6, 6.12, 6.18 and 7.2, this week needs 6.6.160, 6.12.114, 6.18.58 and 7.2.12, which are higher than last week’s. Update again.

Does mainline 7.3 include these fixes?
602 of the 655 live records list 7.3 as the mainline fix version. Mainline 7.3 was released on 18 October 2026. A few records list a different mainline version or none, so check the record.

Which record needs the highest stable versions this week?
CVE-2026-99083, a ksmbd out-of-bounds write. It needs 6.6.160, 6.12.114, 6.18.58 and 7.2.12. It matters only if you run the ksmbd in-kernel SMB server.

Further reading

• CVE-2026-99083 on cve.org
• CVE-2026-98805 on cve.org
• linux-cve-announce mailing list archive
• kernel.org releases
• Linux kernel CVE process documentation
• TECH VEDA kernel CVE tracker
• Previous edition: Linux Kernel CVEs, 11 – 17 Oct 2026