CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99042

The Linux kernel contains a vulnerability in the io_uring/net subsystem where io_connect_bpf_populate() fails to correctly populate connect.port and connect.v6_addr for 24-byte sockaddr_in6 structures. Because the function only populates these fields when addr_len is 28 bytes or greater, a filter...

EUVD-2026-108837

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99041 ip6_gre: remove obsolete ERSPAN PMTU update

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

EUVD-2026-108836

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

CVE-2026-99041

The Linux kernel contains a vulnerability in the ip6_gre module where a tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb. When mirred redirects this to a native ip6erspan device , the legacy PMTU update in ip6erspan_tunnel_xmit() incorrectly treats the metadata destination as a ...

CVE-2026-99041 ip6_gre: remove obsolete ERSPAN PMTU update

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

CVE-2026-99040 KEYS: Fix add_key() race with keyring restriction

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...

CVE-2026-99040

A race condition exists in the Linux kernel 's add_key() function due to how __key_create_or_update() snapshots keyring->restrict_link before acquiring the destination keyring's semaphore. This allows a writer with write permissions on the destination keyring to observe a lack of restriction, ...

CVE-2026-99040 KEYS: Fix add_key() race with keyring restriction

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...

EUVD-2026-108835

In the Linux kernel, the following vulnerability has been resolved: KEYS: Fix addkey race with keyring restriction keycreateorupdate snapshots keyring-restrictlink before taking the destination keyring's semaphore. keyringrestrict installs a restriction while holding that semaphore. This allows a...

CVE-2026-99039 memstick: core: wait for request completion before freeing card

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

EUVD-2026-108834

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99039

A slab-use-after-free vulnerability exists in the Linux kernel memstick subsystem within the memstick_alloc_card() and memstick_set_rw_addr() functions. The issue arises because the subsystem uses wait_for_completion_timeout() without a cancellation callback for in-flight requests. If the timeout...

CVE-2026-99039 memstick: core: wait for request completion before freeing card

In the Linux kernel, the following vulnerability has been resolved: memstick: core: wait for request completion before freeing card In memstickalloccard and memsticksetrwaddr, waitforcompletiontimeout is used to wait for device identification and address configuration requests to complete. The...

CVE-2026-99038 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

EUVD-2026-108833

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...

CVE-2026-99038 memstick: rtsx_usb_ms: complete requests after eject instead of dropping them

In the Linux kernel, the following vulnerability has been resolved: memstick: rtsxusbms: complete requests after eject instead of dropping them memstickcheck can pass its host-removing check just before rtsxusbmsdrvremove sets eject/removing. Its next request is then silently dropped:...