CVE-2026-99074 ipv4: stop PMTU walk when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

EUVD-2026-108739

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99073

The Linux kernel contains a vulnerability where an IPv4 Forwarding Information Base (FIB) dump could lead to a null pointer dereference. The issue occurs because fib_dump_info_fnhe() uses a loop bound that may become invalid if an RTM_NEWNEXTHOP operation replaces a nexthop group with fewer paths...

CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99072

A vulnerability exists in the Linux kernel networking stack related to ipv4 route notifications. The issue occurs because fib_nlmsg_size() performs an RCU-only call where fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between these two oper...

EUVD-2026-108738

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

CVE-2026-99072 ipv4: stop route notification sizing when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

CVE-2026-99072 ipv4: stop route notification sizing when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

CVE-2026-99071

The Linux kernel contains a vulnerability related to asynchronous route notifications for hardware flag changes. Specifically, the fib_alias_hw_flags_set() function sizes the socket buffer (skb) using fib_nlmsg_size() and subsequently fills it with fib_dump_info() while only holding RCU. When nex...

CVE-2026-99071 ipv4: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

EUVD-2026-108737

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

CVE-2026-99071 ipv4: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv4: do not warn on route notification size race Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added asynchronous route notifications for hardware flag changes. fibaliashwflagsset sizes t...

EUVD-2026-108736

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070 ipv6: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99070

The Linux kernel contains a vulnerability related to an IPv6 route notification size race. Specifically, in fib6_info_hw_flags_set() , the socket buffer (skb) is sized using rt6_nlmsg_size() but populated via rt6_fill_node() . When nexthop compatibility mode is enabled, a concurrent replacement c...

CVE-2026-99070 ipv6: do not warn on route notification size race

In the Linux kernel, the following vulnerability has been resolved: ipv6: do not warn on route notification size race fib6infohwflagsset sizes the skb with rt6nlmsgsize and later fills it with rt6fillnode. With nexthop compatibility mode enabled, a concurrent replacement can grow the group betwee...

CVE-2026-99069

The Linux kernel contains a type confusion vulnerability in the ati_remote2 driver. The issue arises because the channel_mask and mode_mask attributes were moved to the bound usb_interface devices, but the show and store callbacks were not updated and continued to invoke to_usb_device() on a usb_...

CVE-2026-99069 Input: ati_remote2 - fix type confusion in device attribute handlers

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...

CVE-2026-99069 Input: ati_remote2 - fix type confusion in device attribute handlers

In the Linux kernel, the following vulnerability has been resolved: Input: atiremote2 - fix type confusion in device attribute handlers Previously, the channelmask and modemask attributes were registered on the parent usbdevice via sysfscreategroup. When commit b20d6bf8014b "Input: ati-remote2 -...