CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

EUVD-2026-103545

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98631

The Linux kernel contains a vulnerability in the xsk component within the xsk_map_gen_lookup() function. The root cause is the use of BPF_JMP_IMM to compare a 32-bit key against max_entries. Because BPF immediates are sign-extended to 64 bits, a max_entries value of 0x80000000 or higher creates a...

CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

EUVD-2026-103544

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98630

The Linux kernel contains a vulnerability in the eth: fbnic component related to improper error cleanup. When a payload page pool allocation fails, the pointer is populated with an error pointer; however, the cleanup path incorrectly passes this error pointer to page_pool_destroy() instead of the...

CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

EUVD-2026-103543

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

CVE-2026-98629

The Linux kernel contains a vulnerability in the net/sched: cls_u32 component regarding manual hash table handle IDR aliasing . A u32 hash table created with an explicit handle keys its IDR entry on the raw handle, but the destroy path frees it using handle2id(handle). For handles in the 0x800..0...

CVE-2026-98628 bpf: Make post-verification instruction rewrites killable

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

EUVD-2026-103542

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

CVE-2026-98628

The Linux kernel bpf verifier contains a vulnerability where certain post-verification instruction rewrite passes—specifically within bpf_opt_remove_nops() —do not check for signals or reschedule. This allows a privileged loader to submit a large number of unconditional jumps, causing the verifie...

CVE-2026-98628 bpf: Make post-verification instruction rewrites killable

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

CVE-2026-98627 bpf: Preserve packet pointer class displacement in regsafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

CVE-2026-98627

The Linux kernel contains a vulnerability in the bpf subsystem's regsafe() function. The issue arises because the function fails to preserve the displacement between registers that share a packet pointer ID. This logic flaw allows the explored path to license an out-of-bounds packet access on a p...

CVE-2026-98627 bpf: Preserve packet pointer class displacement in regsafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

EUVD-2026-103541

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...