SUSE CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

AZL-108860 CVE-2026-98850 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

DEBIAN-CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

EUVD-2026-103790

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850 net/packet: prevent TX_RING byte count overflow

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

The Linux kernel contains a vulnerability in net/packet where the tpacket_snd() function fails to bound the len_sum variable. Because userspace can recycle completed frames concurrently, len_sum can wrap into a negative range after sufficient transmissions. Specifically, certain frame sizes can p...

CVE-2026-98850 net/packet: prevent TX_RING byte count overflow

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

PT-2026-117069

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.3-rc4 Description An integer overflow occurs in the tpacket snd function when processing SEND REQUEST frames in a TX ring. The function accumulates packet lengths into a signed integer len sum, which is not...

Linux Distros Unpatched Vulnerability : CVE-2026-98850

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum...

PT-2026-128447

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TX RING byte count overflow tpacket snd drains every SEND REQUEST frame in a TX ring and adds each valid packet length to the signed int len sum. Userspace can recycle completed frames concurrently, so a singl...

PT-2026-98654

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vdpa sim net component where the function vringh iov pull iotlb returns a signed byte count. When a TX pull fails, the resulting negative error value is added to a...

DEBIAN-CVE-2026-89480

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89631 smb: client: reject a tree connect response whose byte count is too small

In the Linux kernel, the following vulnerability has been resolved: smb: client: reject a tree connect response whose byte count is too small CIFSTCon bounds its strnlen over the byte area with the server's ByteCount minus two, which for ByteCount 0 or 1 goes negative as an int and converts to a...

CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

Linux kernel security vulnerabilities

A security vulnerability exists in Linux kernel version 5.0. It arises because nvme-tcp fails to compare the number of bytes already received with the length of command requests when receiving data. As a result, the controller may respond to a read request of 4096 bytes by sending a response of 5...

SUSE CVE-2026-80831

In the Linux kernel, the following vulnerability has been resolved: crypto: mxs-dcp - fix source scatterlist length access mxsdcpaesblockcrypt uses sgdmalen without mapping the source scatterlist with dmamapsg first. Therefore, sgdmalen is invalid and could return zero or a stale DMA length,...