EUVD-2026-103667

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98622 net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98621 net: gue: reject invalid REMCSUM offsets

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

EUVD-2026-103666

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98621 net: gue: reject invalid REMCSUM offsets

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98621

The Linux kernel contains a vulnerability where the REMCSUM option can cause an integer underflow . The gue_remcsum() function passes an absolute checksum start and field offset to skb_remcsum_process(), which calculates the difference and stores it in a u16 variable. If the offset is less than t...

CVE-2026-98620 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

CVE-2026-98620

The Linux kernel contains a vulnerability in the mtk_eth_soc ethernet driver. If register_netdev() fails for one of the devices in mtk_probe() , the error path skips the necessary mtk_unreg_dev() call. This causes previously registered devices to be freed by mtk_free_dev() while still in the NETR...

EUVD-2026-103665

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

CVE-2026-98620 net: ethernet: mtk_eth_soc: unregister net_devices in case of probe failure

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: unregister netdevices in case of probe failure If registernetdev fails for one of the MTKMAXDEVS devices in mtkprobe, the error path jumps to errdeinitppe, skipping mtkunregdev. The previously registered...

CVE-2026-98619

The Linux kernel contains a vulnerability where the ETHTOOL_TEST ioctl runs without the required rtnl_lock for certain ops-locked drivers. Because the ioctl path became rtnl-optional , drivers like fbnic and bnxt perform offline self-tests that tear down and reopen the interface using only the ne...

CVE-2026-98619 net: ethtool: keep rtnl_lock for the ioctl self test

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

EUVD-2026-103664

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

CVE-2026-98619 net: ethtool: keep rtnl_lock for the ioctl self test

In the Linux kernel, the following vulnerability has been resolved: net: ethtool: keep rtnllock for the ioctl self test An offline self test that brings the interface down and back up with netifclose / netifopen requires rtnllock for both. Since the ethtool IOCTL path became rtnl-optional for...

CVE-2026-98618

The Linux kernel contains a vulnerability in the fbnic driver related to standalone channels. The issue arises because the driver's allocation path excludes FBNIC_MAX_TXQS from the layout. In a 64-Tx/64-Rx configuration, the system records 128 vectors but only allocates 64, resulting in NULL entr...

CVE-2026-98618 eth: fbnic: Handle maximum standalone channels

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

EUVD-2026-103663

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

CVE-2026-98618 eth: fbnic: Handle maximum standalone channels

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

CVE-2026-98618

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Handle maximum standalone channels Standalone channels use one NAPI vector for each Tx and Rx queue. fbnic's allocation path excludes FBNICMAXTXQS from that layout. A 64-Tx/64-Rx configuration therefore records 128...

CVE-2026-98617 eth: fbnic: use the Rx queue napi pointer to find the napi vector

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: use the Rx queue napi pointer to find the napi vector The queue management ndos pick the napi vector for an Rx queue with: nv = fbn-napiidx % fbn-numnapi; The issue is this is only correct in the cases where there are...