CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98489 net: atl1c: fix soft lockup on out-of-range tpd_cons read

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98489 net: atl1c: fix soft lockup on out-of-range tpd_cons read

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98489

The Linux kernel contains a vulnerability in the atl1c driver where hardware can report an out-of-range tpd_cons value (seen as 0xffff ) during a PCIe link or MAC reset. This causes a loop to spin indefinitely, leading to a soft lockup . The issue was reproduced using a Qualcomm Atheros AR8151 v2...

EUVD-2026-103729

In the Linux kernel, the following vulnerability has been resolved: net: atl1c: fix soft lockup on out-of-range tpdcons read The hardware can report an out-of-range tpdcons seen as 0xffff while the PCIe link/MAC is resetting. An out-of-range value can never be reached and the loop below would spi...

CVE-2026-98488 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98488 net: atl1e: fix soft lockup on out-of-range hw_next_to_clean read

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

EUVD-2026-103728

In the Linux kernel, the following vulnerability has been resolved: net: atl1e: fix soft lockup on out-of-range hwnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98488

The Linux kernel contains a vulnerability in the atl1e driver where the hardware can report an out-of-range hw_next_to_clean value (specifically 0xffff ) while the PCIe link or MAC is resetting. This out-of-range value causes a loop to spin forever, resulting in a soft lockup . The fix involves t...

CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98487 net: bridge: mdb: restart port group walk after deletion

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98487

The Linux kernel is affected by a slab-use-after-free vulnerability in the network bridge multicast database (mdb ) component. The issue occurs in br_mdb_flush_pgs() when it maintains a pointer-to-pointer cursor while walking mp->ports. If br_multicast_del_pg() re-enters the same MDB entry via...

EUVD-2026-103727

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mdb: restart port group walk after deletion brmdbflushpgs keeps a pointer-to-pointer cursor while walking mp-ports. brmulticastdelpg can re-enter the same MDB entry through brmulticastsgdelexcludeports and unlink oth...

CVE-2026-98486 net: ena: fix MMIO read buffer leak on probe failure

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

EUVD-2026-103726

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

CVE-2026-98486

The Linux kernel contains a memory leak vulnerability within the ena network driver. The ena_device_init() function allocates a coherent DMA buffer for MMIO read responses via ena_com_mmio_reg_read_request_init(). However, if ena_probe() fails after initialization succeeds, the error path fails t...

CVE-2026-98486 net: ena: fix MMIO read buffer leak on probe failure

In the Linux kernel, the following vulnerability has been resolved: net: ena: fix MMIO read buffer leak on probe failure enadeviceinit initializes the MMIO read mechanism with enacommmioregreadrequestinit, which allocates a coherent DMA buffer for MMIO read responses. The normal removal path...

CVE-2026-98485 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98485 netfilter: ip6t_rt: fix zero-address non-strict match out-of-bounds read

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6trt: fix zero-address non-strict match out-of-bounds read rtmt6check permits rules to be configured with rtinfo-addrnr == 0 even when address matching IP6TRTFSTMASK is requested. In the IP6TRTFSTNSTRICT path, rtmt6...

CVE-2026-98485

The Linux kernel contains an out-of-bounds read vulnerability in the netfilter: ip6t_rt component. The issue occurs because rt_mt6_check() allows rules to be configured with rtinfo->addrnr == 0 even when address matching (IP6T_RT_FST_MASK) is requested. In the IP6T_RT_FST_NSTRICT path, the rt_...