CVE-2026-81002 xdp: fix zero-copy frame layout

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

EUVD-2026-76325

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

CVE-2026-81002

CVE-2026-81002 is a critical (CVSS 9.8) memory corruption flaw in the Linux kernel's XDP component. The xdp_convert_zc_to_xdp_frame() function clones an AF_XDP zero-copy packet into an order-0 page but incorrectly advertises PAGE_SIZE as the frame size, allowing the frame to overlap skb_shared_in...

CVE-2026-81002 xdp: fix zero-copy frame layout

In the Linux kernel, the following vulnerability has been resolved: xdp: fix zero-copy frame layout xdpconvertzctoxdpframe clones an XSK packet into an order-0 page and advertises PAGESIZE as its frame size. It allows the copied frame to occupy the page tail needed by skbsharedinfo and records ze...

CVE-2026-81000 net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

EUVD-2026-76324

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...

CVE-2026-81001 slip: fix use-after-free in sl_sync()

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...

CVE-2026-81000

CVE-2026-81000 affects the Linux kernel TUN/TAP driver . The root cause is an integer underflow in tun_get_user(): when Open vSwitch (OVS) propagates an oversized headroom request from another port, SKB_MAX_HEAD(align) underflows, causing tun_alloc_skb() to place skb->data outside the allocate...

CVE-2026-81001

A use-after-free race condition exists in the Linux kernel's SLIP (Serial Line Internet Protocol) driver , specifically in sl_sync() (drivers/net/slip/slip.c). The slip_devs[] table stores bare net_device pointers without reference counting. Because netdev_run_todo() drops the RTNL lock before ca...

CVE-2026-81001 slip: fix use-after-free in sl_sync()

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...

EUVD-2026-76323

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-81000 net: tun: bound receive headroom

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-81000

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tungetuser uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align is...

CVE-2026-81001

In the Linux kernel, the following vulnerability has been resolved: slip: fix use-after-free in slsync slipdevs stores bare netdevice pointers and takes no reference on them. slsync and slalloc walk that table from slipopen under rtnllock, while an entry is dropped by slfreenetdev, which slsetup...

CVE-2026-80999 net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleepin...

CVE-2026-80999

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleepin...

CVE-2026-80999

CVE-2026-80999 affects the Linux kernel 's Realtek DSA driver (net: dsa: realtek). The root cause is that rtl83xx_reset_assert() and rtl83xx_reset_deassert() invoke the non-sleeping gpiod_set_value() for the reset GPIO. When that GPIO is backed by a sleeping controller such as an I2C I/O expander...

EUVD-2026-76322

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleepin...

CVE-2026-80999 net: dsa: realtek: use gpiod_set_value_cansleep for reset GPIO

In the Linux kernel, the following vulnerability has been resolved: net: dsa: realtek: use gpiodsetvaluecansleep for reset GPIO rtl83xxresetassert and rtl83xxresetdeassert are only called from the probe path, which may sleep and is not timing-critical. When the reset GPIO is provided by a sleepin...

CVE-2026-80997

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...