CVE-2026-98011

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhfchange accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

CVE-2026-98012

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

CVE-2026-98012

The Linux kernel contains a vulnerability in the net/sched: sfq component where the sfq_change() function fails to properly restrict the quantum value. By providing a crafted size table causing qdisc_pkt_len to reach approximately 2 GiB, an attacker can set quantum=1 to trigger a deficit-refill l...

EUVD-2026-86665

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

EUVD-2026-86662

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98010

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drrchangeclass rejects explicit quantum==0 but falls back to pschedmtu with no floor. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 or a zero pschedmtu on a...

CVE-2026-98009

The Linux kernel contains a vulnerability in the net/sched: ets component where the ets_qdisc_change() function falls back to psched_mtu() without a floor for bands lacking an explicit quantum. An attacker with CAP_NET_ADMIN privileges can use a crafted size table to cause qdisc_pkt_len to reach ...

CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98010

The Linux kernel contains a vulnerability in the net/sched subsystem where the drr_change_class() function fails to properly clamp the quantum value during a fallback to psched_mtu(). Specifically, while explicit zeros are rejected, the absence of a floor allows a crafted size table to cause qdis...

EUVD-2026-86663

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drrchangeclass rejects explicit quantum==0 but falls back to pschedmtu with no floor. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 or a zero pschedmtu on a...

CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

CVE-2026-97989

The Linux kernel contains a vulnerability in vduse where vduse_validate_config() fails to properly validate the vq_align parameter, checking only the upper bound. This allows invalid values to reach vring_create_virtqueue_map(). Specifically, because split-ring helpers use align - 1 as a bit mask...

EUVD-2026-86642

In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIOFACCESSPLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale rin...

CVE-2026-97988

The Linux kernel contains a vulnerability in vhost-net and vhost-vsock related to vring access during IOTLB transitions . When VIRTIO_F_ACCESS_PLATFORM changes, cached vring pointers and IOTLB metadata may be interpreted in the wrong address space, potentially leaving stale ring mappings in use. ...

CVE-2026-97988 vhost: invalidate vring access on IOTLB transitions

In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIOFACCESSPLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale rin...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

EUVD-2026-86638

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97982

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...

EUVD-2026-86636

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...

CVE-2026-97982

The Linux kernel contains a vulnerability in the net: ethernet: cortina driver. Specifically, the gmac_rx() function incorrectly returns the remaining NAPI budget instead of the number of packets received. This causes an idle poll to report a full budget and remain scheduled. The fix involves upd...