CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

CVE-2026-98857 ipvs: bound LBLCR and LBLC cache growth

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

CVE-2026-98857

The Linux kernel contains a vulnerability where the ip_vs_lblcr_new() and ip_vs_lblc_new() functions create cache entries for every previously unseen destination address. Because the max_size parameter only triggers periodic reclamation after the limit is exceeded—and does not reclaim actively us...

EUVD-2026-103797

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

CVE-2026-98857

In the Linux kernel, the following vulnerability has been resolved: ipvs: bound LBLCR and LBLC cache growth ipvslblcrnew and ipvslblcnew create cache entries for every previously unseen destination address. The table maxsize only tells the periodic collector to reclaim entries after the cache has...

EUVD-2026-103796

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe stops at B when arming a new probe C at A+4. It leaves A...

CVE-2026-98856

The Linux kernel contains a vulnerability in the kprobes subsystem on x86 architectures. When arming a new probe (C) near an existing optkprobe (A), the get_optimized_kprobe() function incorrectly stops at a disarmed probe (B). This allows the INT3 instruction for probe C to overwrite the jump di...

CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe stops at B when arming a new probe C at A+4. It leaves A...

CVE-2026-98856 kprobes: Skip disarmed probes when checking optkprobe overlap

In the Linux kernel, the following vulnerability has been resolved: kprobes: Skip disarmed probes when checking optkprobe overlap On x86, an optkprobe at A replaces five bytes with a jump. If a disabled probe B is at A+2, getoptimizedkprobe stops at B when arming a new probe C at A+4. It leaves A...

CVE-2026-98855 of/overlay: put property on deadprops only after changeset add succeeds

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds addchangesetproperty links a new property of a not-yet-live target node into the node's deadprops list before handing it to ofchangesetaddproperty. If that...

CVE-2026-98855

The Linux kernel contains a vulnerability where the add_changeset_property() function incorrectly links a new property into a target node's deadprops list before the property addition succeeds. If of_changeset_add_property() fails, the error path frees the property but leaves the freed pointer in...

CVE-2026-98855 of/overlay: put property on deadprops only after changeset add succeeds

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds addchangesetproperty links a new property of a not-yet-live target node into the node's deadprops list before handing it to ofchangesetaddproperty. If that...

EUVD-2026-103795

In the Linux kernel, the following vulnerability has been resolved: of/overlay: put property on deadprops only after changeset add succeeds addchangesetproperty links a new property of a not-yet-live target node into the node's deadprops list before handing it to ofchangesetaddproperty. If that...

CVE-2026-98854 of/overlay: only treat a positive changeset id as registered

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

EUVD-2026-103794

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

CVE-2026-98854

The Linux kernel contains a vulnerability in the of/overlay component where of_overlay_fdt_apply() incorrectly stores the return value of idr_alloc() in ovcs->id before verifying its success. If the allocation fails, ovcs->id becomes negative, causing free_overlay_changeset() to bypass its ...

CVE-2026-98854 of/overlay: only treat a positive changeset id as registered

In the Linux kernel, the following vulnerability has been resolved: of/overlay: only treat a positive changeset id as registered ofoverlayfdtapply stores the idralloc return value in ovcs-id before checking it. On failure the stored id is negative, freeoverlaychangeset's "if ovcs-id" check passes...

EUVD-2026-103793

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inetgsosegment or ipv6gsosegment for each nested IP header. encaplevel tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stac...

CVE-2026-98853 net: gso: limit recursive IP-in-IP segmentation

In the Linux kernel, the following vulnerability has been resolved: net: gso: limit recursive IP-in-IP segmentation IP-in-IP GSO can re-enter inetgsosegment or ipv6gsosegment for each nested IP header. encaplevel tracks header bytes, not callback depth, so a deep chain can exhaust the kernel stac...

EUVD-2026-103792

In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b "net: correctly handle tunneled traffic on IPV6CSUM GSO fallback" split skbgsohasextensionhdr into mutually exclusive branches on skb-encapsulation. This d...