CVE-2026-98030

The Linux kernel contains a vulnerability in the net: dsa: bcm_sf2 component where the bcm_sf2_cfp_rule_get_all() function fails to check the caller's buffer size (nfc->rule_cnt) when walking the cfp.unique bitmap into rule_locs[]. Because the ETHTOOL_GRXCLSRLALL ioctl does not require CAP_NET...

CVE-2026-98029

The Linux kernel contains a vulnerability in the nfp driver where the nfp_net_get_fs_loc() function fails to check the cmd->rule_cnt when dumping entries into the rule_locs[] buffer. Because ETHTOOL_GRXCLSRLALL does not require CAP_NET_ADMIN privileges and uses a user-supplied rule_cnt to size...

CVE-2026-98030 net: dsa: bcm_sf2: bound the CFP rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

CVE-2026-98027 net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

EUVD-2026-86681

In the Linux kernel, the following vulnerability has been resolved: eth: nfp: drop the replaced rule from the list when reprogramming fails nfpnetfsadd replaces an existing rule by deleting it from the hardware, decrementing nn-fs.count and programming the new one. If nfpnetfsaddhw fails the old...

EUVD-2026-86680

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

EUVD-2026-86649

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every virtqueue and passes leftover cookies to freebuf, which treats them as...

CVE-2026-97995

The Linux kernel contains a vulnerability in the virtio_console driver where the remove_vqs() function incorrectly passes leftover cookies to free_buf(). If a control message remains on c_ovq when a device is unbound, free_buf() treats these cookies as struct port_buffer and reads past the ports_...

CVE-2026-97995 virtio_console: do not free control-out buffers on remove

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every virtqueue and passes leftover cookies to freebuf, which treats them as...

CVE-2026-97995 virtio_console: do not free control-out buffers on remove

In the Linux kernel, the following vulnerability has been resolved: virtioconsole: do not free control-out buffers on remove sendcontrolmsg publishes &portdev-cpkt as the control-out virtqueue cookie. removevqs walks every virtqueue and passes leftover cookies to freebuf, which treats them as...

CVE-2026-97994 vhost/vdpa: reject VRING_NUM larger than device max

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

EUVD-2026-86648

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97994

The Linux kernel contains a vulnerability in the vhost-vdpa component where vhost_vring_set_num() accepts a queue size that exceeds the device's maximum capacity without proper validation against get_vq_num_max(). A process with access to /dev/vhost-vdpa-* can exploit this to configure a queue la...

CVE-2026-97994 vhost/vdpa: reject VRING_NUM larger than device max

In the Linux kernel, the following vulnerability has been resolved: vhost/vdpa: reject VRINGNUM larger than device max vhostvringsetnum accepts any non-zero power-of-two queue size that fits in 16 bits. vhost-vdpa then passes that value to setvqnum without comparing it with getvqnummax. A process...

CVE-2026-97991 vdpa_sim_blk: reject out-of-range sector starts

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

CVE-2026-97991 vdpa_sim_blk: reject out-of-range sector starts

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

EUVD-2026-86645

In the Linux kernel, the following vulnerability has been resolved: vdpasimblk: reject out-of-range sector starts vdpasimblkcheckrange logs an invalid start sector but continues validating the request. The subsequent unsigned capacity subtraction can underflow and let an out-of-range buffer offse...

CVE-2026-97991

The Linux kernel contains a vulnerability in vdpa_sim_blk where the vdpasim_blk_check_range() function logs an invalid start sector but fails to halt validation. This allows an unsigned capacity subtraction to underflow, leading to an out-of-range buffer offset reaching the data path. The invalid...

CVE-2026-97976 Bluetooth: btintel_pcie: validate packet_len before skb_put_data

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in...

EUVD-2026-86630

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate packetlen before skbputdata btintelpciesubmitrxwork reads packetlen from rfhhdr without checking if it exceeds the RX buffer size. An oversized packetlen can lead to an out-of-bounds read in...