EUVD-2026-103610

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

CVE-2026-98565 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98563 net: phylink: record the PHY only once bringup cannot fail

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

CVE-2026-98563 net: phylink: record the PHY only once bringup cannot fail

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

CVE-2026-98563

A vulnerability in the Linux kernel networking stack's phylink component allows for a use-after-free scenario. The issue occurs because phylink_bringup_phy() stores a PHY in pl->phydev before a fallible step (like phy_eee_rx_clock_stop()). If that step fails, the system unwinds using phy_detac...

EUVD-2026-103608

In the Linux kernel, the following vulnerability has been resolved: net: phylink: record the PHY only once bringup cannot fail phylinkbringupphy stores the PHY in pl-phydev before its last fallible step: on a MAC whose phylink ops implement LPI, phyeeerxclockstop can fail with a real MDIO error...

CVE-2026-98562

The Linux kernel contains a race condition in the libwx component related to Tx timestamp handling . The vulnerability occurs because wx->ptp_tx_skb is shared between the Tx path, the PTP auxiliary worker, and timestamp cleanup paths without proper serialization. Specifically, wx_ptp_clear_tx_...

CVE-2026-98562 net: libwx: fix races in Tx timestamp handling

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptptxskb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WXSTATEPTPTXINPROGRESS bit prevents multiple Tx paths from submitting timesta...

EUVD-2026-103607

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptptxskb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WXSTATEPTPTXINPROGRESS bit prevents multiple Tx paths from submitting timesta...

CVE-2026-98562 net: libwx: fix races in Tx timestamp handling

In the Linux kernel, the following vulnerability has been resolved: net: libwx: fix races in Tx timestamp handling wx-ptptxskb is shared between the Tx path, the PTP auxiliary worker and the timestamp cleanup paths. The WXSTATEPTPTXINPROGRESS bit prevents multiple Tx paths from submitting timesta...

CVE-2026-98561

A vulnerability exists in the Linux kernel regarding how the nfp driver handles IPsec RX states. Specifically, the nfp_net_ipsec_rx() function drops the XArray lock before acquiring a reference to the xfrm_state. This creates a race condition where the delete path can erase the entry and drop the...

CVE-2026-98561 nfp: hold IPsec RX state under the XArray lock

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfpnetipsecrx drops the XArray lock before taking a reference to the xfrmstate it found. The delete path can erase the entry and drop the last state reference in that interval. RX ca...

EUVD-2026-103606

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfpnetipsecrx drops the XArray lock before taking a reference to the xfrmstate it found. The delete path can erase the entry and drop the last state reference in that interval. RX ca...

CVE-2026-98561 nfp: hold IPsec RX state under the XArray lock

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfpnetipsecrx drops the XArray lock before taking a reference to the xfrmstate it found. The delete path can erase the entry and drop the last state reference in that interval. RX ca...

CVE-2026-98560

The Linux kernel contains a vulnerability in the net/rds component where __rds_conn_create() incorrectly computes npaths from the caller's transport before determining if a connection to a local address should be handled by the loopback transport . This mismatch causes the path init loop to alloc...

CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

EUVD-2026-103605

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

CVE-2026-98559

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the net/smc component. The issue exists because the smcr_port_err() function traverses smc_lgr_list.list without acquiring the smc_lgr_list.lock , which allows a concurrent call to smc_lgr_terminate_sched() to free an lgr object wh...