CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90102 NFSv4/pnfs: key the data server cache on the NFS version

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90101

CVE-2026-90101 affects the bnxt_en driver in the Linux kernel. The driver calls hwmon_notify_event() with the platform device as its first parameter instead of the expected hardware monitoring device . This API contract violation results in undefined behavior and may lead to a crash . The fix pas...

CVE-2026-90102

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

EUVD-2026-81695

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

CVE-2026-90101

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...

CVE-2026-90100 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

CVE-2026-90100

CVE-2026-90100 affects the Linux kernel PTP (Precision Time Protocol) netc driver. The root cause is a period truncation in net_timer_enable_perout(): a u64 max_period bound exceeds U32_MAX when integral_period > 0, allowing a period_ns value to pass the range check but be silently truncated t...

CVE-2026-90100 ptp: netc: fix period truncation and potential divide-by-zero in PEROUT

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

EUVD-2026-81961

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

CVE-2026-90100

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

CVE-2026-90098

CVE-2026-90098 affects the Linux kernel sparx5 network driver. The root cause is that sparx5_set_rx_mode() executes with netif_addr_lock_bh held (an atomic context), yet calls sparx5_mact_learn() / sparx5_mact_forget() , which acquire a mutex and poll the MAC access command register via readx_pol...

EUVD-2026-81960

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

CVE-2026-90098 net: sparx5: fix sleep in atomic context in MAC table access

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

EUVD-2026-81959

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

CVE-2026-90099

CVE-2026-90099 affects the Linux kernel's net/sched (traffic control) subsystem. Allocations in tc classifier *_change() paths use GFP_KERNEL without __GFP_ACCOUNT , allowing unprivileged users in a user+network namespace to pin kernel memory outside memcg charging by creating large numbers of tc...

CVE-2026-90098 net: sparx5: fix sleep in atomic context in MAC table access

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

CVE-2026-90099

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

CVE-2026-90098

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

CVE-2026-90099 net/sched: account classifier filter allocations to memcg

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...