CVE-2026-98068 net/rds: don't let rds_conn_shutdown() consume a concurrent drop

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

CVE-2026-98068 net/rds: don't let rds_conn_shutdown() consume a concurrent drop

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

EUVD-2026-86722

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

EUVD-2026-86721

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

CVE-2026-98069 net/rds: acquire the fastpath locks in rds_conn_shutdown()

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

CVE-2026-98068

The Linux kernel contains a race condition in the RDS (Reliable Datagram Sockets) protocol. Specifically, the rds_conn_shutdown() function could prematurely consume an RDS_CONN_ERROR state caused by a concurrent drop. This occurs when rds_tcp_accept_one() attaches a new socket; if a concurrent dr...

CVE-2026-98069

The Linux kernel is vulnerable to a race condition in the RDS (Reliable Datagram Sockets) subsystem within net/rds. Specifically, rds_conn_shutdown() fails to properly own the fastpath bit locks (RDS_IN_XMIT and RDS_RECV_REFILL ) while quiescing the transmit and receive-refill paths. On weakly or...

CVE-2026-98052

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98052 net: bcmasp: clear txcb->last before writing each descriptor

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: clear txcb-last before writing each descriptor bcmaspxmit only wrote txcb-last = true for the final fragment of an SKB; non-final fragments left the field untouched. If a descriptor slot was reused while it still hel...

CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98051 net: bcmasp: fix tx_spb_ring_full() checking same slot cnt times

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

EUVD-2026-86704

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

CVE-2026-98030

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98030 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98030

The Linux kernel contains a vulnerability in the net: dsa: bcm_sf2 component where the bcm_sf2_cfp_rule_get_all() function fails to check the caller's buffer size (nfc->rule_cnt) when walking the cfp.unique bitmap into rule_locs[]. Because the ETHTOOL_GRXCLSRLALL ioctl does not require CAP_NET...

CVE-2026-98030 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98027 net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

CVE-2026-98027

The Linux kernel contains a vulnerability in the net: dsa: mv88e6xxx driver. The mv88e6xxx_get_rxnfc() function incorrectly uses rxnfc->rule_cnt as a write index while dumping the policy IDR, which clobbers the input value representing the caller's buffer size. Because ETHTOOL_GRXCLSRLALL does...