CVE-2026-98322 netfilter: nft_nat: fully initialise new_addr in netmap setup

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

CVE-2026-98322

The Linux kernel contains a vulnerability in netfilter: nft_nat where the nft_nat_setup_netmap() function fails to fully initialize the new_addr variable. Specifically, for IPv4 mapping , only the 4-byte .ip member is written to an on-stack union nf_inet_addr. However, the code subsequently copie...

EUVD-2026-93307

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

CVE-2026-98321 netfilter: nf_nat: unregister and release hooks on error

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: unregister and release hooks on error If nfhookentriesinsertraw fails, the NAT hooks get never released, resulting in a memleak. Postpone setting natprotonet-nathookops when the hooks are registered to simplify...

EUVD-2026-93306

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: unregister and release hooks on error If nfhookentriesinsertraw fails, the NAT hooks get never released, resulting in a memleak. Postpone setting natprotonet-nathookops when the hooks are registered to simplify...

CVE-2026-98321

The Linux kernel contains a vulnerability in the netfilter: nf_nat component where a failure in nf_hook_entries_insert_raw() prevents NAT hooks from being released. This flaw results in a memory leak . The issue is addressed by postponing the setting of nat_proto_net->nat_hook_ops during hook ...

CVE-2026-98320 netfilter: flowtable: hold reference on ct until flow is released

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

CVE-2026-98320

The Linux kernel is affected by a vulnerability in the netfilter flowtable component. The root cause is that nf_ct_put() releases the ct->ext area immediately, which allows the datapath to potentially refer to the incorrect conntrack due to rcu typesafe semantics. To resolve this, the kernel m...

CVE-2026-98320 netfilter: flowtable: hold reference on ct until flow is released

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

EUVD-2026-93305

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

EUVD-2026-93303

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98319 drm: Fix drm_pending_vblank_event leak in error path for out_fence_ptr

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmpendingvblankevent leak in error path for outfenceptr When an outfenceptr is provided but DRMMODEPAGEFLIPEVENT is not set, a drmpendingvblankevent will be allocated. If later, there is an allocation failure or another...

CVE-2026-98318 smb: client: validate absolute native symlink targets before NT fixups

In the Linux kernel, the following vulnerability has been resolved: smb: client: validate absolute native symlink targets before NT fixups With symlinkroot unset, an absolute target is copied without conversion to an NT drive path. Later code still assumes an NT prefix is present when modifying t...

CVE-2026-98318

The Linux kernel contains a vulnerability in the smb client where absolute native symlink targets are not properly validated before NT fixups when symlinkroot is unset. Because the code incorrectly assumes an NT prefix is present, providing a target like "/ab" causes out-of-bounds writes to the s...

CVE-2026-98319

The Linux kernel contains a memory leak vulnerability in the DRM (Direct Rendering Manager) subsystem. When an out_fence_ptr is provided without the DRM_MODE_PAGE_FLIP_EVENT flag set, a drm_pending_vblank_event is allocated. If a subsequent failure occurs during setup_out_fence() , the event fail...

EUVD-2026-93304

In the Linux kernel, the following vulnerability has been resolved: drm: Fix drmpendingvblankevent leak in error path for outfenceptr When an outfenceptr is provided but DRMMODEPAGEFLIPEVENT is not set, a drmpendingvblankevent will be allocated. If later, there is an allocation failure or another...

CVE-2026-98317

The Linux kernel contains a vulnerability in the neighbour component where the NDTPA_INTERVAL_PROBE_TIME_MS parameter lacks proper validation. Specifically, the lack of a .validation_type allowed values like 0 to be accepted. Additionally, a u64 to u32 silent cast in nla_get_msecs() allowed large...

EUVD-2026-93302

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...

CVE-2026-98317 neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.

In the Linux kernel, the following vulnerability has been resolved: neighbour: Enforce min/max to NDTPAINTERVALPROBETIMEMS. NDTPAINTERVALPROBETIMEMS sets .type and .min but misses .validationtype, so no validation is applied: ynl --family rt-neigh --do setneightbl \ --json '"name": "arpcache",...