CVE-2026-98370

The Linux kernel contains a use-after-free vulnerability in the xfrm component during ALLOCSPI requests. The issue arises because xfrm_state_netlink() and xfrm_alloc_userspi() perform redundant alloc_compat() calls. For compatibility requests, this causes the translator to misinterpret the 228-by...

CVE-2026-98369 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-98369 xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98369

The Linux kernel is affected by a vulnerability in the xfrm subsystem where xfrm_trans_reinject was converted from a tasklet to a workqueue. Because workqueue workers run in process context, they fail to enter an RCU read-side critical section, causing RCU lockdep warnings when invoking finish ca...

EUVD-2026-93354

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcureadlock, skbdstforce and devhold for xfrmtransreinject syzbot reported a suspicious RCU usage warning in ip6pktdrop: WARNING: suspicious RCU usage in ip6pktdrop include/net/addrconf.h:389 suspicious...

EUVD-2026-93355

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98368

The Linux kernel contains a vulnerability in the ESP (Encapsulating Security Payload) implementation where it fails to downgrade zerocopy managed frags before mutating the skb frag array on the out-of-place output path. Specifically, when SKBFL_MANAGED_FRAG_REFS is set, the ESP component mutates ...

EUVD-2026-93353

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98368 esp: downgrade zerocopy managed frags before mutating skb frags

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98368 esp: downgrade zerocopy managed frags before mutating skb frags

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98367 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

CVE-2026-98367

A Use-After-Free (UAF) vulnerability exists in the Linux kernel within the RDMA/siw component. The issue occurs because the state_lock is released before the error path cleanup when siw_qp_modify() fails during siw_accept(). This creates a race condition window where a concurrent ibv_modify_qp() ...

CVE-2026-98367 RDMA/siw: Clear association under lock if siw_qp_modify fails in siw_accept

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

EUVD-2026-93352

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

CVE-2026-98366

A slab-use-after-free vulnerability exists in the Linux kernel 's RDMA/rxe driver. The root cause is that the rxe_rereg_user_mr() function reassigns the memory region's protection domain (mr->ibmr.pd) before validating the IB_MR_REREG_ACCESS argument. If the access check fails, the function re...

CVE-2026-98366 RDMA/rxe: validate access flags before swapping the MR's PD

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

EUVD-2026-93351

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98366 RDMA/rxe: validate access flags before swapping the MR's PD

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...