EUVD-2026-86635

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

CVE-2026-97981 net: ethernet: cortina: Count dropped frames as NAPI work

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

CVE-2026-97967

In the Linux kernel, the following vulnerability has been resolved: hwmon: corsair-cpro Remove debugfs entries when probe fails ccpdebugfsinit registers debugfs files whose private data is the devm allocated ccp. If hwmondeviceregisterwithinfo fails right after it, ccpprobe returns without removi...

CVE-2026-97958 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

EUVD-2026-86812

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97958 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97958

The Linux kernel is vulnerable to a CPU hogging issue in net/sched: cls_api due to how tc_ctl_chain() handles repeated RTM_GETCHAIN requests. If a netlink socket sends these requests without consuming the responses, netlink_attachskb() may return -EAGAIN when the receive buffer is full, causing t...

CVE-2026-97948 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

CVE-2026-97948

The Linux kernel contains a vulnerability in the powerpc/eeh driver where a recursive locking issue can cause the eehd to hang. The root cause is that the pci_rescan_remove_lock is held during eeh_handle_normal_event() and eeh_reset_device(), but the code path in eeh_rmv_device() failed to remove...

CVE-2026-97948 powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver

In the Linux kernel, the following vulnerability has been resolved: powerpc/eeh: Fix recursive locking on devices without EEH sensitive driver The commit 1010b4c012b0 "powerpc/eeh: Make EEH driver device hotplug safe" refactored the EEH code such that the pcirescanremovelock is held at the...

CVE-2026-97928 drm/amdgpu: skip the VMID 0 flush for VRAM

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: skip the VMID 0 flush for VRAM Clear-on-release only runs on VRAM, which amdgputtmmapbuffer reaches via its direct MC address without programming a GART window, yet the wipe still forces a VMID 0 flush. On GFX11 e.g...

CVE-2026-97928

The Linux kernel contains a vulnerability in the drm/amdgpu driver where the amdgpu_ttm_map_buffer() function incorrectly forces a VMID 0 flush when performing a clear-on-release on VRAM . Because VRAM is accessed via a direct memory controller (MC) address without a programmed GART window , this...

EUVD-2026-86778

In the Linux kernel, the following vulnerability has been resolved: tracing/userevents: Don't destroy fields when event removal fails destroyuserevent destroys the event's fields before attempting to remove the trace event call. If usereventsetcallvisible fails, e.g. because the event is still...

CVE-2026-97900

The Linux kernel contains a vulnerability in the drm/drm_exec component where drm_exec_prepare_array() fails to call drm_exec_lock_contended() when num_objects is zero. This oversight breaks the locking invariant required by drm_exec_lock_obj() . Specifically, drivers that chain multiple calls, s...

CVE-2026-97900 drm/drm_exec: fix up contended obj when num_objects is 0

In the Linux kernel, the following vulnerability has been resolved: drm/drmexec: fix up contended obj when numobjects is 0 drmexecpreparearray silently returns success without calling drmexeclockcontended when numobjects is zero. This breaks the invariant upheld by drmexeclockobj, where every ent...

EUVD-2026-86746

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

EUVD-2026-86744

In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...

EUVD-2026-86729

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97598

The Linux kernel contains a vulnerability in the ipv4: fib component where the fib_empty_table() function probes every table ID starting from 1 until a free one is found. In a dense set of IDs, this causes each probe to walk a growing hash chain while the RTNL is held. To mitigate this, the autom...

CVE-2026-97597 ipv6: flowlabel: cap duplicate leases per socket

In the Linux kernel, the following vulnerability has been resolved: ipv6: flowlabel: cap duplicate leases per socket ipv6flowlabelget allocates an ipv6flsocklist entry for every successful GET. The recheck path for a compatible existing flowlabel links another lease without applying any lease...