CVE-2026-98383 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfskbpulldata for LWTSEG6LOCAL An LWTSEG6LOCAL program can invalidate its cached SRH with bpflwtseg6adjustsrh and then call bpfskbpulldata. The latter may reallocate skb-head, leaving the per-CPU SRH pointer...

CVE-2026-98382

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98381

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

EUVD-2026-95537

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98382

The Linux kernel contains a vulnerability where bound-only BPF programs can incorrectly match sibling ports due to a fallback mechanism in __bpf_offload_dev_match(). Because these programs typically have NULL offdevs , unrelated netdevs can compare as equal on offload-registered netdevs. An attac...

CVE-2026-98382 bpf: Reject dev-bound-only programs on other devices

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98382 bpf: Reject dev-bound-only programs on other devices

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98381 veth: manage XDP program pointers during channel resize

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

EUVD-2026-95536

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

CVE-2026-98381

The Linux kernel contains a vulnerability where the veth component fails to properly manage XDP program pointers during a channel resize. Specifically, the function veth_set_channels() tears down XDP resources for removed RX queues but fails to clear rq->xdp_prog. This allows queues to retain ...

CVE-2026-98381 veth: manage XDP program pointers during channel resize

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...

CVE-2026-98380

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

EUVD-2026-95535

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98380

A vulnerability exists in the Linux kernel 's net/sched component where tcf_idr_delete_index() fails to properly handle IDR error pointers . Specifically, if an unlocked classifier removes an action and reserves the same IDR slot with ERR_PTR(-EBUSY) between the lookup and deletion, the system tr...

CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98380 net/sched: reject IDR error pointers when deleting actions

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject IDR error pointers when deleting actions tcfactiondelete drops the reference held by its lookup before calling tcfidrdeleteindex with the saved action index. An unlocked classifier can remove that action and...

CVE-2026-98379

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...

EUVD-2026-95534

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...

CVE-2026-98379

The Linux kernel contains a vulnerability in the netfilter: ip6t_rpfilter component. The ip6_route_lookup() function can return a route where rt6i_idev is NULL if an external nexthop device's MTU is lowered below IPV6_MIN_MTU, causing the inet6_dev to be torn down while the route remains in the F...

CVE-2026-98379 netfilter: ip6t_rpfilter: reject routes without inet6_dev

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trpfilter: reject routes without inet6dev ip6routelookup can return an error-free route whose rt6iidev is NULL. Lowering an external nexthop device's MTU below IPV6MINMTU tears down its inet6dev while fib6ifdown...