CVE-2026-98630 eth: fbnic: Fix payload page pool error cleanup

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98630

The Linux kernel contains a vulnerability in the eth: fbnic component related to improper error cleanup. When a payload page pool allocation fails, the pointer is populated with an error pointer; however, the cleanup path incorrectly passes this error pointer to page_pool_destroy() instead of the...

EUVD-2026-103544

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Fix payload page pool error cleanup The payload page pool pointer contains an error pointer when its allocation fails. The cleanup path passes that error pointer to pagepooldestroy instead of destroying the header pag...

CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

CVE-2026-98629

The Linux kernel contains a vulnerability in the net/sched: cls_u32 component regarding manual hash table handle IDR aliasing . A u32 hash table created with an explicit handle keys its IDR entry on the raw handle, but the destroy path frees it using handle2id(handle). For handles in the 0x800..0...

CVE-2026-98629 net/sched: cls_u32: fix manual hash table handle IDR aliasing

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

EUVD-2026-103543

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix manual hash table handle IDR aliasing A u32 hash table created with an explicit handle 'tc filter add ... handle 801: u32 divisor N' keys its IDR entry on the raw handle, while the destroy paths free it und...

CVE-2026-98628 bpf: Make post-verification instruction rewrites killable

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

CVE-2026-98628 bpf: Make post-verification instruction rewrites killable

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

EUVD-2026-103542

In the Linux kernel, the following vulnerability has been resolved: bpf: Make post-verification instruction rewrites killable After docheck returns, the verifier runs several instruction rewrite passes. Some of them patch or remove one instruction at a time. Each operation moves the remaining...

CVE-2026-98628

The Linux kernel bpf verifier contains a vulnerability where certain post-verification instruction rewrite passes—specifically within bpf_opt_remove_nops() —do not check for signals or reschedule. This allows a privileged loader to submit a large number of unconditional jumps, causing the verifie...

CVE-2026-98627 bpf: Preserve packet pointer class displacement in regsafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

CVE-2026-98627 bpf: Preserve packet pointer class displacement in regsafe()

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

CVE-2026-98627

The Linux kernel contains a vulnerability in the bpf subsystem's regsafe() function. The issue arises because the function fails to preserve the displacement between registers that share a packet pointer ID. This logic flaw allows the explored path to license an out-of-bounds packet access on a p...

EUVD-2026-103541

In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve packet pointer class displacement in regsafe regsafe maps packet pointer IDs between states and checks that each current register range is a subset of the corresponding explored register range. It does not, however,...

CVE-2026-98626

The Linux kernel contains a vulnerability in its CO-RE (Compile Once - Run Everywhere) mechanism. The bpf_core_patch_insn() function incorrectly poisons relocation targets before verifying if they are valid. This allows malformed metadata to replace critical instructions such as jumps, calls, exi...

CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

EUVD-2026-103540

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98625 netfilter: flowtable: publish HW_DEAD after worker is done

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...