CVE-2026-98104 net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

CVE-2026-98099 ipv6: mcast: use rcu_assign_pointer() for __rcu list updates

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

EUVD-2026-86929

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98073

In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in devchangenetnamespace. syzbot reported the warning in cfg80211pernetexit. 0 The repro does the following: 1. create two device in root netns and non-root netns 2. assign the sam...

CVE-2026-98072

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98071

The Linux kernel contains a data race in the net/rds component within the rds_conn_path_reset() function. The vulnerability stems from the use of a plain store (cp->cp_flags = 0) to wipe the flag word, while other accessors use atomic bitops concurrently. This race condition can cause updates ...

CVE-2026-98072

The Linux kernel contains a vulnerability in the net/rds component where the release_in_xmit() function fails to maintain necessary memory ordering. Specifically, it uses clear_bit_unlock() to clear RDS_IN_XMIT, which lacks the full barrier required for a subsequent load of the wait queue head. T...

CVE-2026-98072 net/rds: use wq_has_sleeper() in release_in_xmit()

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

EUVD-2026-86725

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

EUVD-2026-86724

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98071 net/rds: clear cp_flags bits individually in rds_conn_path_reset()

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98072 net/rds: use wq_has_sleeper() in release_in_xmit()

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

CVE-2026-98071 net/rds: clear cp_flags bits individually in rds_conn_path_reset()

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98070

The Linux kernel contains a vulnerability in the net/rds component where rds_tcp_reset_callbacks() fails to properly quiesce the transmit path. On weakly ordered architectures, the function's reliance on sampling the RDS_IN_XMIT bit rather than owning it creates a store-buffering pattern. This al...

CVE-2026-98070

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98070 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

EUVD-2026-86723

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98070 net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98068

The Linux kernel contains a race condition in the RDS (Reliable Datagram Sockets) protocol. Specifically, the rds_conn_shutdown() function could prematurely consume an RDS_CONN_ERROR state caused by a concurrent drop. This occurs when rds_tcp_accept_one() attaches a new socket; if a concurrent dr...