CVE-2026-97958 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97956

In the Linux kernel, the following vulnerability has been resolved: net: netfailover: Fix the deadlock in netfailoverslavenamechange This is a sibling fix of commit b84c5632c7b3 "net: netfailover: Fix the deadlock in slave register". There is netdevlockops in the upper callers, so using netifopen...

EUVD-2026-86808

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97955

In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails manaxdpset publishes the new program into apc-bpfprog before it allocates anything, because manapreallocrxbufs sizes the buffers from it via managetrxbufcfg. Wh...

CVE-2026-97954

The Linux kernel contains a vulnerability in the net/rds component where rds_message_map_pages() incorrectly assigns PAGE_SIZE bytes to every scatterlist entry, even for partial pages. On systems with a PAGE_SIZE greater than 8192 bytes, this causes the scatterlist to map bytes beyond the end of ...

CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953

A vulnerability exists in the Linux kernel 's stmmac driver related to the TX descriptor availability check for TSO traffic . The stmmac_tso_xmit() function incorrectly estimates the required free TX descriptors by assuming the payload is split into TSO_MAX_BUFF_SIZE chunks. This logic underestim...

CVE-2026-97618

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

EUVD-2026-86749

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

CVE-2026-97618

The Linux kernel contains a vulnerability in the io_uring/net subsystem where a recv/recvmsg operation using MSG_TRUNC causes the system to overconsume buffers. Specifically, if an incoming packet exceeds the provided buffer size, the net layer returns the full packet length instead of the number...

CVE-2026-97615

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

CVE-2026-97616

The Linux kernel contains a memory leak vulnerability within the net/sched: act_api component. During a batched RTM_NEWACTION request, tcf_idr_check_alloc() takes a temporary reference on an action. If a subsequent action fails to initialize, tcf_action_destroy() uses strict release semantics tha...

EUVD-2026-86746

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

CVE-2026-97616

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

EUVD-2026-86747

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

CVE-2026-97615

The Linux kernel contains a vulnerability in the net: bridge component related to how CFM and MRP frame handlers are registered. Because these protocols registered a global br_frame_type whose hlist_node is linked into the per-bridge frame_type_list , enabling the protocol on multiple bridges ins...

CVE-2026-97615 net: bridge: use option bits for CFM/MRP frame handlers

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

CVE-2026-97614

The Linux kernel contains a vulnerability in the net: dsa: tag_brcm component where the legacy FCS tagger fails to declare required tailroom. When a nonlinear skb reaches the tagger, it calculates the CRC over bytes starting at skb->data, causing it to read past the linear head into unrelated ...