CVE-2026-99079

The Linux kernel (specifically the net/mlx5e driver) is affected by a vulnerability where a stale XSK buffer is released during a refill retry. When an XDP redirect to an AF_XDP socket fails due to a full RX ring, the XSK core frees the buffer. During a batched refill of a legacy cyclic RQ, the d...

CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

EUVD-2026-108744

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

CVE-2026-99078

The Linux kernel contains a vulnerability in the net/mlx5e driver where AF_XDP on a striding RQ can result in stale XSK buffer releases during an MPWQE refill retry . If an XSK allocation returns -ENOMEM, the actual_wq_head is not advanced, causing a subsequent NAPI poll to retry the same WQE. Th...

CVE-2026-99077

The Linux kernel contains a vulnerability where FIB nexthop exceptions (FNHE) are only created if a quoted UDP packet matches an existing socket. This allows off-path attackers to conduct a side-channel attack on the FNHE cache to discover ephemeral ports of connected UDP sockets. Previous mitiga...

EUVD-2026-108743

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99077 ipv4: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99077 ipv4: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99076

The Linux kernel is vulnerable to a side-channel attack in the IPv6 implementation. When ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, the kernel previously only created an exception in the IPv6 exception cache if the UDP packet matched an existi...

CVE-2026-99076 ipv6: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

EUVD-2026-108742

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

CVE-2026-99076 ipv6: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

CVE-2026-99075

The Linux kernel contains a vulnerability in the rust_binder component regarding a reschedule node refcount update during thread exit. When a thread exits via BINDER_THREAD_EXIT, pending work items are cancelled. If a thread exits while holding a pending node refcount increment as deferred work, ...

CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

EUVD-2026-108741

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99074

The Linux kernel contains a vulnerability where a null-pointer dereference can occur during the PMTU (Path MTU) walk process. The root cause is a race condition: while RCU protects the lifetime of nexthop groups, it does not ensure that fib_info_num_path() and fib_info_nhc() observe the same grou...

EUVD-2026-108740

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

CVE-2026-99074 ipv4: stop PMTU walk when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...