CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

CVE-2026-98808

The Linux kernel contains a buffer overflow vulnerability in the bcm_sysport_get_stats() function when running on SYSTEMPORT Lite . The issue occurs because the code incorrectly uses an iteration index (i) instead of a compacted index (j) to store values in a destination data buffer. Since the bu...

EUVD-2026-103894

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

EUVD-2026-103893

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98809

A vulnerability exists in the Linux kernel Bluetooth subsystem related to how the hci_sync component handles the cmd_sync backlog during unregistration. Specifically, the hci_unregister_dev() function calls hci_cmd_sync_clear() , which waits for hci_cmd_sync_work() to complete. Because the worker...

CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98808 net: systemport: Fix buffer overflow in bcm_sysport_get_stats()

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98809 Bluetooth: hci_sync: don't drain cmd_sync backlog on unregister

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisync: don't drain cmdsync backlog on unregister hciunregisterdev disables cmdwork and cmdtimer, then calls hcicmdsyncclear, whose cancelworksync waits for hcicmdsyncwork to return. That worker dequeues and runs ever...

CVE-2026-98807

The Linux kernel (net/mlx5) contains a slab-out-of-bounds memory access vulnerability. The issue stems from the mlx5_handle_changeupper_event() and mlx5_handle_changeinfodata_event() functions, which incorrectly call bonding-specific APIs—specifically bond_slave_get_rcu() and bond_is_slave_inacti...

EUVD-2026-103892

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

EUVD-2026-103891

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

CVE-2026-98806 octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

CVE-2026-98806

The Linux kernel contains a vulnerability in the octeontx2-pf driver related to BPID assignment when CONFIG_DCB is enabled. The root cause is an assumption that the queue_to_pfc_map is always initialized; however, for SDP VFs , this map is not initialized, leading to invalid memory access . The f...

CVE-2026-98806 octeontx2-pf: Fix aura BPID assignment when CONFIG_DCB is enabled

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: Fix aura BPID assignment when CONFIGDCB is enabled Previously, BPID assignment under CONFIGDCB assumed queuetopfcmap was always initialized. For SDP VFs this leads to invalid memory access as it was not initialized...

CVE-2026-98804

The Linux kernel contains a use-after-free vulnerability in the net: page_pool component when CONFIG_PAGE_POOL_STATS=y is enabled. The root cause is that page_pool_recycle_ring_bulk() updates recycle statistics after dropping the producer lock. This allows page_pool_release() to pass its producer...

EUVD-2026-103890

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent GCM nonce reuse on peer key changes TIPC can encrypt traffic between nodes using a different transmit key for each node. In this mode, the AES-GCM nonce for a packet sent to a known peer consists of a 32-bit prefix ...

CVE-2026-98805

The Linux kernel contains a vulnerability in the TIPC (Transparent Inter-Process Communication) protocol where encryption traffic between nodes can suffer from AES-GCM nonce reuse . Specifically, when a peer reports a change in its receive key, TIPC resets the 64-bit counter in the peer's RX cryp...

CVE-2026-98804 net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool...