CVE-2026-99072 ipv4: stop route notification sizing when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

CVE-2026-99072

A vulnerability exists in the Linux kernel networking stack related to ipv4 route notifications. The issue occurs because fib_nlmsg_size() performs an RCU-only call where fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between these two oper...

CVE-2026-99071 ipv4: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

CVE-2026-99071 ipv4: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

EUVD-2026-108737

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

CVE-2026-99071

The Linux kernel contains a vulnerability related to asynchronous route notifications for hardware flag changes. Specifically, the fib_alias_hw_flags_set() function sizes the socket buffer (skb) using fib_nlmsg_size() and subsequently fills it with fib_dump_info() while only holding RCU. When nex...

EUVD-2026-108736

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070 ipv6: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070 ipv6: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070

The Linux kernel contains a vulnerability related to an IPv6 route notification size race. Specifically, in fib6_info_hw_flags_set() , the socket buffer (skb) is sized using rt6_nlmsg_size() but populated via rt6_fill_node() . When nexthop compatibility mode is enabled, a concurrent replacement c...

CVE-2026-99069

The Linux kernel contains a type confusion vulnerability in the ati_remote2 driver. The issue arises because the channel_mask and mode_mask attributes were moved to the bound usb_interface devices, but the show and store callbacks were not updated and continued to invoke to_usb_device() on a usb_...

CVE-2026-99069 Input: ati_remote2 - fix type confusion in device attribute handlers

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99069 Input: ati_remote2 - fix type confusion in device attribute handlers

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

EUVD-2026-108735

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99068

The Linux kernel contains a memory leakage vulnerability within the ALSA subsystem, specifically affecting the ctxfi component. The root cause is located in the dao_clear_input() function, which was simplified but omitted necessary kfree() calls. While the function correctly removes mapper entrie...

CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

EUVD-2026-108734

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

CVE-2026-99068 ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix memory leakage when clearing DAO input mappers Commit e576e7843c0d "ALSA: ctxfi: Simplify daoclearleft,rightinput functions" centralized the DAO input mapper clearing logic in daoclearinput, but omitted the kfree...

EUVD-2026-108733

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...

CVE-2026-99067 btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()

In the Linux kernel, the following vulnerability has been resolved: btrfs: scrub: fix localroot reference leak in scrubprintwarninginode When pathsfrominode fails, scrubprintwarninginode jumps to err without dropping the reference taken by btrfsgetfsroot, leaking a reference to the root every tim...