CVE-2026-99027

The Linux kernel contains a slab-use-after-free vulnerability within the net: team component. The issue occurs because a nonzero dev_queue_xmit() result does not return ownership of the skb . Consequently, when an override port's qdisc drops the packet, the queue override helper incorrectly attem...

CVE-2026-99026

The Linux kernel contains a memory management issue in the net: team component. Specifically, when a broadcast transmission has no txable port, the bc_transmit() function returns false without consuming the original skb , yet team_xmit() returns NETDEV_TX_OK. This causes AF_PACKET sends to retain...

EUVD-2026-108821

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

CVE-2026-99026 net: team: free skb when broadcast has no txable port

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

CVE-2026-99026 net: team: free skb when broadcast has no txable port

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

CVE-2026-99025 openvswitch: fix soft lockup in the netlink flow dump

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovsflowcmddump calls ovsflowstatsget for eve...

CVE-2026-99025 openvswitch: fix soft lockup in the netlink flow dump

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovsflowcmddump calls ovsflowstatsget for eve...

CVE-2026-99025

A vulnerability in the Linux kernel 's openvswitch component causes a soft lockup and system panic during a netlink flow dump . The issue occurs because ovs_flow_cmd_dump() calls ovs_flow_stats_get(), which uses spin_unlock_bh(). This repeatedly enables local softirqs, causing the dumping thread ...

EUVD-2026-108819

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix soft lockup in the netlink flow dump A production compute node carrying a few thousand datapath flows hit a soft lockup inside a single netlink flow dump and panicked. ovsflowcmddump calls ovsflowstatsget for eve...

CVE-2026-99024 optee: register TEE devices only once fully initialized

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

EUVD-2026-108818

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99024 optee: register TEE devices only once fully initialized

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99024

The Linux kernel contains a vulnerability where optee_probe() calls tee_device_register() for both client and supplicant devices before the struct optee is fully initialized. Because tee_device_register() creates device nodes and links the device into the tee class, the device becomes accessible ...

CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023

The Linux kernel contains a memory leak vulnerability in the pcie-m2 power sequencing driver. Specifically, the function of_regulator_bulk_get_all() allocates a consumers array and expects the caller to release it. However, the file pwrseq-pcie-m2.c failed to free this array, resulting in a memor...

EUVD-2026-108817

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99022 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

CVE-2026-99022 regulator: ltc3676: don't read the write-only HRST and CLIRQ registers

In the Linux kernel, the following vulnerability has been resolved: regulator: ltc3676: don't read the write-only HRST and CLIRQ registers HRST 0x1e and CLIRQ 0x1f are write-only command strobes. Writing HRST triggers a hard reset of the chip and writing CLIRQ clears the interrupt; reading them...

CVE-2026-99022

The Linux kernel contains a vulnerability in the ltc3676 regulator driver where the HRST (0x1e) and CLIRQ (0x1f) registers are incorrectly accessible for reading. Although these are write-only command strobes—where HRST triggers a hard reset and CLIRQ clears an interrupt—performing a read operati...