CVE-2026-90106 net: bridge: arp/nd proxy: fix reading neigh ha

In the Linux kernel, the following vulnerability has been resolved: net: bridge: arp/nd proxy: fix reading neigh ha Currently neigh ha address is read directly, but that can result in torn/partial reads if the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address...

CVE-2026-90106

CVE-2026-90106 is a Linux kernel vulnerability in the network bridge ARP/ND proxy subsystem. The root cause is that the neighbour hardware address (neigh ha) is read directly from memory, which can result in torn or partial reads if the neighbour entry is being updated concurrently. The fix repla...

EUVD-2026-81698

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

CVE-2026-90104

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90105

CVE-2026-90105 is a Linux kernel vulnerability in the vxlan subsystem. The arp/neigh_reduce function reads the neighbor hardware address directly, which can lead to partial reads while the neighbor entry is concurrently being updated. The fix replaces direct reads with neigh_ha_snapshot, which ta...

CVE-2026-90105 vxlan: fix reading neigh ha

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

CVE-2026-90104 NFSv4.1: zero referring call lists before decoding

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

EUVD-2026-81697

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90104

CVE-2026-90104 affects the Linux kernel's NFSv4.1 callback handling. In decode_cb_sequence_args(), the csa_rclists array is allocated with kmalloc_objs(), leaving referring_call_list entries uninitialized. Because decode_rc_list() only assigns rcl_refcalls when the list is non-empty, a valid empt...

CVE-2026-90104 NFSv4.1: zero referring call lists before decoding

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

CVE-2026-90105

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

CVE-2026-90105 vxlan: fix reading neigh ha

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

CVE-2026-90103

CVE-2026-90103 is a buffer sizing flaw in the Linux kernel's NFSv4.2 flexfiles layout driver . The encode_layoutstats_maxsz macro budgets only 256 bytes for the layoutupdate4 body, but a per-data-server flexfiles record (filehandle + IO latency entries + nfstime4 + bool) can exceed that, especial...

EUVD-2026-81696

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90103 NFSv4.2: fix LAYOUTSTATS send buffer exhaustion

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

CVE-2026-90102

CVE-2026-90102 is a Linux kernel vulnerability in the NFSv4/pnfs flexfiles layout driver. The per-net data server cache in nfs4_pnfs_ds_add() keyed entries only on the multipath address set, ignoring the NFS version. When one address legitimately serves both NFSv3 and NFSv4 , two deviceids alias ...

CVE-2026-90101 bnxt_en: Fix call to hardware monitoring event handler

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...

EUVD-2026-81962

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...