CVE-2026-98491

A vulnerability in the Linux kernel (net: openvswitch: conntrack) allows for a Use-After-Free (UAF) condition. The issue occurs when a socket buffer (skb) with an unconfirmed conntrack (ct) entry is cloned. If both clones attempt to commit while possessing different sets of extensions, the second...

EUVD-2026-103731

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98491 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

EUVD-2026-103730

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the net: openvswitch: conntrack component. The issue arises because a raw pointer to the extensions area is inserted into the expectations list during helper calls. If a connection is not yet confirmed, subsequent calls to *_ex...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98489 net: atl1c: fix soft lockup on out-of-range tpd_cons read

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

EUVD-2026-103729

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98489 net: atl1c: fix soft lockup on out-of-range tpd_cons read

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98489

The Linux kernel contains a vulnerability in the atl1c driver where hardware can report an out-of-range tpd_cons value (seen as 0xffff ) during a PCIe link or MAC reset. This causes a loop to spin indefinitely, leading to a soft lockup . The issue was reproduced using a Qualcomm Atheros AR8151 v2...

CVE-2026-98488 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

EUVD-2026-103728

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98488 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98488

The Linux kernel contains a vulnerability in the atl1e driver where the hardware can report an out-of-range hw_next_to_clean value (specifically 0xffff ) while the PCIe link or MAC is resetting. This out-of-range value causes a loop to spin forever, resulting in a soft lockup . The fix involves t...

CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98487

The Linux kernel is affected by a slab-use-after-free vulnerability in the network bridge multicast database (mdb ) component. The issue occurs in br_mdb_flush_pgs() when it maintains a pointer-to-pointer cursor while walking mp->ports. If br_multicast_del_pg() re-enters the same MDB entry via...

CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

EUVD-2026-103727

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98486

The Linux kernel contains a memory leak vulnerability within the ena network driver. The ena_device_init() function allocates a coherent DMA buffer for MMIO read responses via ena_com_mmio_reg_read_request_init(). However, if ena_probe() fails after initialization succeeds, the error path fails t...