CVE-2026-97520

In the Linux kernel, a vulnerability in gfs2 was fixed: gfs2_quota_init() checks for duplicate quota_change IDs while holding qd_lock and the quota hash bucket bitlock. That path used gfs2_qd_search_bucket(), which takes a lockref reference via lockref_get_not_dead(). On PREEMPT_RT this may sleep, which is not allowed under the bucket bitlock, triggering 'sleeping function called from invalid context'. The fix uses a no-ref bucket lookup in this path and continues duplicate handling without taking a lockref there. It refactors gfs2_qd_search_bucket() to build on top of the no-ref helper so lookup traversal stays in one place.

In the Linux kernel, a vulnerability in drm/xe was fixed: in xe_devcoredump_snapshot_free(), ss->gt may be NULL when the snapshot was never fully populated (e.g., when cleanup is triggered without a prior capture). Guard the xe_guc_capture_put_matched_nodes() call with IS_ERR_OR_NULL() to prevent a null dereference. In xe_devcoredump_free(), the deferred work is only queued when a coredump is captured, so guard cancel_work_sync() with a check on coredump->captured.

In the Linux kernel, a vulnerability in cfg80211 was fixed: rejecting duplicate entries in wiphy->cipher_suites. Duplicates do not describe any additional capability, but cfg80211 currently accepts them and leaves individual consumers to deal with them. The WEXT compatibility code appends a WEP key length for each WEP cipher entry, which can overflow the fixed iw_range::encoding_size array returned by SIOCGIWRANGE. The fix rejects duplicate cipher suite entries in wiphy_register(), causing malformed wiphy descriptions to fail early with -EINVAL.

In the Linux kernel, a vulnerability in nl80211 was fixed: rejecting beacons with bad HE operation. The HE operation element not only needs to be longer than the fixed part, but also have an appropriate size for the variable part inside of it. This is now checked.

In the rtw88 driver, a NULL pointer dereference occurs in rtw_fw_adaptivity_result(). On devices with the 8821CE chip that do not define the edcca_th field, the kernel triggers an oops. The fix adds a NULL check before dereferencing, preventing the crash.

In the i3c svc driver on NPCM845, a false SLVSTART event causes an interrupt storm. After emitting a STOP condition, the controller reports a new event, creating a loop that can lock up the CPU. The fix clears the SLVSTART status bit explicitly after the STOP, breaking the loop.

In the chips-media wave5 driver, a lock issue is detected in handle_dynamic_resolution_change. The call in initialize_sequence does not properly acquire the lock. Additionally, v4l2_ctrl_find and s_ctrl can sleep, so they should not be called while holding the lock. The fix stores the fbc_buf_count value and updates the control after the lock is released.

In the chips-media wave5 driver, a use-after-free risk occurs when removing an instance from the list. The IRQ thread may acquire the spinlock between m2m_ctx release and removal, leading to a null pointer dereference.

In the Qualcomm QSPI SPI driver, incomplete error handling in runtime PM was found. During suspend or resume, the system could be left in an inconsistent state, leading to clock/power imbalances. The fix reorders operations and adds proper error checking with cleanup.

In the mac80211 module, an out-of-bounds access is detected in the function adding the radiotap header for monitoring in NAN mode. When the band is set to NUM_NL80211_BANDS, accessing the sbands array causes an error. The fix avoids accessing the array when the band is invalid.