CVE-2026-98284

The Linux kernel contains a vulnerability where netlink_realloc_groups() uses krealloc() to reallocate the nlk->groups bitmap. If the new size falls into a different kmalloc bucket , the old bitmap is freed immediately while lockless readers—specifically sk_diag_dump_groups() and netlink_nativ...

CVE-2026-98283

The Linux kernel contains a use-after-free vulnerability in the KVM subsystem specifically affecting PPC Book3S HV . The issue exists in the kvmhv_emulate_tlbie_all_lpid() function, which fails to maintain a reference on the kvm_nested_guest pointer after dropping the mmu_lock. A concurrent vCPU ...

EUVD-2026-93211

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

CVE-2026-98282

The Linux kernel contains a vulnerability in the powerpc/iommu component. The issue stems from the iommu_tce_check_ioba function, where the npages argument was being ignored in favor of a constant value of '1' during the unification of IOBA parameter checking for KVM and VFIO . This oversight all...

EUVD-2026-93210

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

EUVD-2026-93209

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98281

The Linux kernel contains a vulnerability where it fails to allocate a private hash on vfork() for CLONE_VM users. Because it is possible to access the mm through vfork() , the kernel must ensure a private hash is allocated to prevent issues with futex waiters. The vulnerability has been resolved...

CVE-2026-98279

The Linux kernel contains a vulnerability in the btrfs filesystem where a lack of space or a qgroup limit during the cleanup of verity items can cause the entire filesystem to be forced into read-only mode. This occurs because rollback_verity() requires its own metadata reservation; if denied, th...

EUVD-2026-93207

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

CVE-2026-98280

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the drm/xe/i2c component. The issue occurs because struct xe_i2c is freed before the SGUnit IRQ is disabled during the unbind path. This creates a small window where the I2C IRQ could be triggered while the structure is already...

EUVD-2026-93208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xei2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xei2cremove a...

CVE-2026-98278

The Linux kernel contains a logic issue where dev_fill_forward_path() triggers a WARN_ON_ONCE warning when a flowtable attempts to offload a flow through a tunnel that resolves back to itself. This routing loop can be configured by any user with CAP_NET_ADMIN privileges. Because ip_tunnel_xmit() ...

EUVD-2026-93206

In the Linux kernel, the following vulnerability has been resolved: net: remove WARNONONCE from the devfillforwardpath loop check ipipfillforwardpath and ip6tnlfillforwardpath look up the route to the tunnel's remote endpoint and set ctx-dev to its device, which is the tunnel itself when that rou...

CVE-2026-98277

The Linux kernel contains a vulnerability in the fbnic driver where the fbnic_tx_map() function fails to ring the doorbell or issue a completion request for packets in a burst if the final packet in that burst is dropped (e.g., due to skb_put_padto(), skb_cow_head(), or a DMA mapping failure). Th...

EUVD-2026-93205

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: ring the doorbell if a burst ends in a drop fbnictxmap skips the doorbell write, and the completion request, for every packet handed to it with xmitmore set, counting on the packet which ends the burst to publish them...

EUVD-2026-93203

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmacirq acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this...

CVE-2026-98275

The Linux kernel contains a vulnerability in the cortina ethernet driver regarding how it handles the RX overrun interrupt . The gmac_irq() function incorrectly acknowledges the interrupt using the RX descriptor error bit from status register 0, instead of the bit reported in status register 4. F...

CVE-2026-98276

The Linux kernel is vulnerable to a use-after-free condition in the networking subsystem. The root cause is a race condition in sock_gettstamp() where sk->sk_flags is modified without holding the socket lock , leading to non-atomic operations. Specifically, a SIOCGSTAMPNS_NEW ioctl can race wi...

EUVD-2026-93204

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98274

The Linux kernel contains a conflict between PSP and the TLS ULP regarding the usage of skb->decrypted and sk->sk_validate_xmit_skb(). To resolve this, PSP is made mutually exclusive with TLS ULP. The fix involves including all TCP ULPs in the sk_has_decrypt_user() check to close potential ...