CVE-2026-98303

The Linux kernel is affected by a vulnerability in icmp_route_lookup() where RTN_UNREACHABLE input routes are not properly rejected. When a forward output route is unusable, the kernel performs a reverse path lookup via ip_route_input(). If the source address is unreachable, ip_route_input() succ...

EUVD-2026-93288

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

EUVD-2026-93287

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

CVE-2026-98302

The Linux kernel contains a NULL pointer dereference vulnerability in the skfp (FDD-II) driver. The issue occurs because skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally without verifying if the network interface is running via netif_running(). On an interface that has never been i...

CVE-2026-98301

The Linux kernel contains a vulnerability in the net: bridge: mst component where the br_mst_set_state() function calls switchdev_port_attr_set() while holding an rcu_read_lock() . This is problematic because the switchdev notifier chain can invoke blocking calls and sleep. The issue is triggered...

EUVD-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

EUVD-2026-93285

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98300

The Linux kernel contains a vulnerability in the tcp_v6_do_rcv() function where a race condition exists between tcp_v6_rcv() and tcp_v6_do_rcv() . A concurrent close() operation can change the state from TCP_LISTEN to TCP_CLOSE , causing skb_clone_and_charge_r() to be called locklessly. This resu...

CVE-2026-98299

The Linux kernel is vulnerable to a division by zero crash in the tcp_rcvbuf_grow() and tcp_rcv_space_adjust() functions within net/ipv4/tcp_input.c. The root cause is that if net.ipv4.tcp_rmem is configured with arbitrarily small values (e.g., 1), sk->sk_rcvbuf is initialized to 1, causing tp...

EUVD-2026-93284

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

CVE-2026-98298

The Linux kernel contains a vulnerability in the dmaengine component, specifically within the mmp_pdma driver. The root cause is an error in the mmp_pdma_prep_slave_sg() function where for_each_sg() incorrectly retrieves the entry length from the list head (sgl) instead of the current entry (sg)....

EUVD-2026-93283

In the Linux kernel, the following vulnerability has been resolved: dmaengine: mmppdma: fix wrong sg length in mmppdmaprepslavesg In mmppdmaprepslavesg, foreachsg iterates the scatterlist putting each entry into 'sg', but the entry length is read from 'sgl' the list head instead of 'sg' the curre...

CVE-2026-98297

A vulnerability exists in the Linux kernel Bluetooth hci_core component where functions hci_send_acl(), hci_send_sco(), and hci_send_iso() unconditionally queue hdev->tx_work. This creates a race condition during hci_dev_close_sync() while draining the hdev->workqueue (triggered by HCIDEVDO...

EUVD-2026-93282

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

CVE-2026-98296

A vulnerability exists in the Linux kernel 's Bluetooth btintel_pcie driver. The function btintel_pcie_prepare_tx() performs an unchecked memcpy to copy skb->len bytes into a fixed DMA slot of 4096 bytes. While oversized packets are currently rejected in btintel_pcie_send_frame(), any future c...

EUVD-2026-93281

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btintelpcie: validate TX skb length in sendsync btintelpciepreparetx copies skb-len bytes into a fixed BTINTELPCIEBUFFERSIZE 4096 DMA slot via an unchecked memcpy. Oversized packets are currently rejected only in...

CVE-2026-98295

The Linux kernel contains a vulnerability in the Bluetooth subsystem related to coredump processing. The function hci_devcd_handle_pkt_init() incorrectly arms dump_timeout and coredump producers without holding an hdev reference . This allows these works to remain live during unregistration, pote...

EUVD-2026-93280

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: coredump: Quiesce dump work on unregister hcidevcdhandlepktinit arms dumptimeout and coredump producers queue dumprx without holding an hdev reference. Unregister leaves both works live, so disconnecting during an acti...

EUVD-2026-93222

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hciqca: Do not write to the serial port after it is closed hciuartclose closes the serdev port if HCIQUIRKNONPERSISTENTSETUP is set for example, for the WCN399x family. A failed hcidevopensync following a successful...

CVE-2026-98294

The Linux kernel contains a vulnerability in the hci_qca driver where the system attempts to write to a serial port after it has been closed. Specifically, if HCI_QUIRK_NON_PERSISTENT_SETUP is set (e.g., for the WCN399x family), a failed hci_dev_open_sync() after a successful qca_setup() leads to...