EUVD-2026-108724

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

EUVD-2026-108852

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

CVE-2026-99057

The Linux kernel contains a memory leak vulnerability in the xen/netfront component. When a response chain contains more slots than the skb's frags can accommodate, xennet_fill_frags() returns an error and xennet_poll() moves to an error path. Because the skb being filled is already dequeued from...

CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

CVE-2026-99056

The Linux kernel contains a race condition in the strparser component, specifically involving the teardown of the parser. The issue arises because strp_recv calls may still be in-flight when strp_done() is invoked, leading to a potential Use-After-Free (UAF) . This condition primarily affects esp...

CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

EUVD-2026-108851

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99055 tcp: reject net_iov in zerocopy receive mapping hints

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

CVE-2026-99055

The Linux kernel contains a vulnerability where the can_map_frag() function dereferences a null pointer when processing net_iov fragments during zerocopy receive mapping . Specifically, skb_frag_page() returns NULL for a net_iov, but can_map_frag() fails to handle this, leading to a null-ptr-dere...

CVE-2026-99055 tcp: reject net_iov in zerocopy receive mapping hints

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

EUVD-2026-108850

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

EUVD-2026-108849

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99054

A race condition exists in the Linux kernel 's tipc component because tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. This allows socket callbacks and subscription events to queue additional work, potentially causing in-...

CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99053

The Linux kernel is vulnerable to a slab-use-after-free in the tipc component. The flaw exists because tipc_node_find_by_name() returns a node after dropping its RCU read lock without obtaining a reference. This creates a race condition where LINK_SET, LINK_GET, or LINK_RESET_STATS handlers may a...

CVE-2026-99053 tipc: hold a reference to nodes found by link name

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

EUVD-2026-108848

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...