CVE-2026-99045 ibmveth: h_free logical LAN on open-fail after register

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...

CVE-2026-99045

The Linux kernel contains a vulnerability in the ibmveth driver. During the ibmveth_open() process, a failure in allocating RX buffer pools caused the execution to jump to out_free_buffer_pools without calling h_free_logical_lan(). This resulted in the PHYP still owning the buffer-list page even ...

CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

EUVD-2026-108839

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044

A use-after-free vulnerability exists in the Linux kernel 's ice driver during dynamic port cleanup. Specifically, the ice_dealloc_dynamic_port() function attempts to access dyn_port->vsi->idx to erase a dynamic port from pf->dyn_ports, but it incorrectly frees the VSI before reading the...

CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

EUVD-2026-108838

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99043

The Linux kernel contains a vulnerability in the ice driver where ice_eswitch_release_repr() incorrectly uses metadata_dst_free() to release the representor's metadata_dst. This function frees memory directly without checking the dst_entry refcount. Consequently, if a representor is torn down whi...

CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99042

The Linux kernel contains a vulnerability in the io_uring/net subsystem where io_connect_bpf_populate() fails to correctly populate connect.port and connect.v6_addr for 24-byte sockaddr_in6 structures. Because the function only populates these fields when addr_len is 28 bytes or greater, a filter...

EUVD-2026-108837

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99041 ip6_gre: remove obsolete ERSPAN PMTU update

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

EUVD-2026-108836

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

CVE-2026-99041

The Linux kernel contains a vulnerability in the ip6_gre module where a tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb. When mirred redirects this to a native ip6erspan device , the legacy PMTU update in ip6erspan_tunnel_xmit() incorrectly treats the metadata destination as a ...

CVE-2026-99041 ip6_gre: remove obsolete ERSPAN PMTU update

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

CVE-2026-99040

A race condition exists in the Linux kernel 's add_key() function due to how __key_create_or_update() snapshots keyring->restrict_link before acquiring the destination keyring's semaphore. This allows a writer with write permissions on the destination keyring to observe a lack of restriction, ...

CVE-2026-99040 KEYS: Fix add_key() race with keyring restriction

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...