CVE-2026-98155

Linux kernel: out-of-bounds read

Risk score: 53/100
CVSS: 7.1 v3.1
Exploit chance (30 days): 0.1%
Published: 25 Sep 2026

Open in the live forecast Today's forecast

What to know

What it is: In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_…
Affected: Linux kernel
Fix: Apply the vendor's security update; see the linked advisory.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Linux kernel: Amber, patch this week. In the Linux kernel, the following vulnerability has been resolved: sctp: fix a TOCTOU race in SCTP_CMD_TIMER_START The SCTP_CMD_TIMER_START handler checks timer_pending() before calling timer_reduce(). The timer can expire and detach between these operations, causing timer_reduce() to rearm the timer without taking t…

The flaws

CVE-2026-98155: Out-of-bounds read (CVSS 7.1 · EPSS 0%)
CVE-2026-98130: Race condition (CVSS 8.1 · EPSS 0%)
CVE-2026-98115: Race condition (CVSS 8.8 · EPSS 0%)
CVE-2026-98052: In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb->last… (CVSS 7.8 · EPSS 0%)

The fix

Fix: Apply the vendor's security update; see the linked advisory.

Who is exposed: Linux kernel

Where it stands

No known exploitation

Connects to

Same weakness: Out-of-bounds read (CWE-125). 348 other warnings in 30 days
Same product: Earlier Linux kernel warnings. 61 in the last 90 days

Why it is Yellow

CVSS 7.1 high
On your watchlist: linux kernel

References

Original description

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Address potential out-of-bounds read in resp_worker() Although 'commit 2feec5ae5df7 ("accel/qaic: Handle DBC deactivation if the owner went away")' fixes the scenario it was intended for by walking the message and only decoding QAIC_TRANS_DEACTIVATE_FROM_DEV, if present, it skipped over the bounds checking code that is included in decode_message(). This could lead to issues such as reading past the slab allocation's end, infinite loops or kernel panics. For those issues to happen, a malformed wire message is needed to be sent from the device. Instead of duplicating the bounds checking code already present in decode_message(), use the function inside resp_worker().

Last activity 25 Sep 2026. Patch Forecast updates every hour.