EUVD-2026-103596

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

EUVD-2026-103597

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98550

The Linux kernel contains a vulnerability in the tipc transport protocol where an incomplete check on GRP_ACK_MSG allows for bc_ackers underflow. Specifically, if grp->bc_ackers is zero, an unexpected ACK with a higher sequence number can wrap the 16-bit counter to 65535, causing tipc_group_bc...

EUVD-2026-103595

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98549

A vulnerability in the Linux kernel TCP stack allows skbs to be improperly collapsed across a boundary in the rtx queue . The issue occurs because tcp_write_collapse_fence() can be a no-op if the sk_write_queue is empty, leading tcp_retrans_try_collapse() or tcp_shift_skb_data() to merge new skbs...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

EUVD-2026-103594

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98548

The Linux kernel contains a use-after-free vulnerability in the SCTP protocol implementation. When an association is in the COOKIE-ECHOED state and receives a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address, the system processes the ERROR chunk via sctp_sf_do_5_2_6_stale(). ...

CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

EUVD-2026-103593

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98547

The Linux kernel is vulnerable to an integer overflow in the prb_calc_retire_blk_tmo() function within the af_packet component. The vulnerability occurs because the function performs 32-bit arithmetic when calculating mbits. A user-controlled tp_block_size (e.g., 256MiB) can cause the calculation...

EUVD-2026-103592

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98546 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98546

The Linux kernel is affected by a vulnerability in the arm64/boot component. The root cause is located in __init_el2_fgt2(), which incorrectly writes a single mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2 . Because PMZR_EL0 is write-only, its trap bit (nPMZR_EL0 ) is never set, causing a PMZR_EL0 wr...