CVE-2026-98497 net/mlx5e: fix swapped IPv6 IPsec policy masks

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: fix swapped IPv6 IPsec policy masks IPv6 XFRM policies may use different source and destination prefix lengths. mlx5eipsecpolicymask builds the corresponding masks independently, but setupfteaddr6 installs each mask in...

CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98496

The Linux kernel contains a vulnerability in the airoha npu driver. Specifically, the airoha_npu_remove() function calls cancel_work_sync() on the wdt_work item, but the watchdog IRQ (requested via devm_request_irq()) is only freed after the .remove() function returns. This allows the airoha_npu_...

EUVD-2026-103736

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98496 net: airoha: npu: cancel wdt_work after releasing the WDT IRQ

In the Linux kernel, the following vulnerability has been resolved: net: airoha: npu: cancel wdtwork after releasing the WDT IRQ airohanpuremove calls cancelworksync on each core's wdtwork, but the watchdog IRQ that queues it is requested with devmrequestirq and is freed only after .remove return...

CVE-2026-98495 net: arp: terminate device name before lookup

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

EUVD-2026-103735

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

CVE-2026-98495

The Linux kernel contains an out-of-bounds read vulnerability in the ARP ioctl functionality. The issue occurs because the kernel copies a user-provided struct arpreq into a stack object, where the arp_dev field can contain IFNAMSIZ bytes without a NUL terminator . When this input is processed by...

CVE-2026-98495 net: arp: terminate device name before lookup

In the Linux kernel, the following vulnerability has been resolved: net: arp: terminate device name before lookup The ARP ioctl copies a user-provided struct arpreq into a stack object. Its arpdev field may contain IFNAMSIZ bytes without a NUL terminator. Such input is passed to devgetbynamercu o...

CVE-2026-98494 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

EUVD-2026-103734

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98494 net: atl1: fix soft lockup on out-of-range cmb_tpd_next_to_clean read

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98494

The Linux kernel contains a vulnerability where the atl1 component can experience a soft lockup . This occurs because the hardware may report an out-of-range value (0xffff ) for cmb_tpd_next_to_clean while the PCIe link or MAC is resetting. This out-of-range value causes a loop to spin forever. T...

CVE-2026-98493

The Linux kernel contains a memory safety vulnerability in the ipconfig component. The function ic_dhcp_init_options() fails to perform proper bounds checking when appending hostname (option 12) and vendor-class (option 60) into the fixed 312-byte bootp_pkt.exten[] buffer, leading to an unbounded...

CVE-2026-98493 net: ipconfig: bound DHCP option construction

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

EUVD-2026-103733

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

CVE-2026-98493 net: ipconfig: bound DHCP option construction

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

CVE-2026-98492 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

CVE-2026-98492

A memory leak vulnerability exists in the Linux kernel 's macb network driver during the macb_alloc() operation. The issue occurs because the error handling path calls macb_free(bp) , which attempts to free buffers from bp->queues[0] before they have been stored. This results in three specific...

CVE-2026-98492 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...