CVE-2026-90112 net: qlcnic: validate unified ROM sections before loading

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

CVE-2026-90112

CVE-2026-90112 affects the qlcnic network driver in the Linux kernel . The unified ROM parser performs unchecked additions and multiplications when forming table and data boundaries, allowing malformed firmware values to wrap before being compared with the firmware size. Additionally, the loader ...

CVE-2026-90112

In the Linux kernel, the following vulnerability has been resolved: net: qlcnic: validate unified ROM sections before loading The unified ROM parser reads directory, product, and data-descriptor fields from the firmware file. Existing validation forms table and data ends with unchecked additions...

EUVD-2026-81703

In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...

CVE-2026-90111

CVE-2026-90111 is a slab use-after-free in the Linux kernel's IPv6 multicast routing (ip6mr) subsystem. When an ingress multicast packet misses the MFC lookup, the skb is queued on the unresolved queue, escaping the receive-side RCU grace period. If the underlying route is subsequently deleted an...

EUVD-2026-81704

In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mrcachereport IPv6 input attaches a non-refcounted NOREF dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mrcacheunresolved places the skb onto the unresolved queue,...

CVE-2026-90110 inetpeer: randomize RB-tree node comparison using SipHash

In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...

CVE-2026-90111 ip6mr: do not clone dst in ip6mr_cache_report()

In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mrcachereport IPv6 input attaches a non-refcounted NOREF dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mrcacheunresolved places the skb onto the unresolved queue,...

CVE-2026-90110 inetpeer: randomize RB-tree node comparison using SipHash

In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...

CVE-2026-90111 ip6mr: do not clone dst in ip6mr_cache_report()

In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mrcachereport IPv6 input attaches a non-refcounted NOREF dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mrcacheunresolved places the skb onto the unresolved queue,...

CVE-2026-90110

In the Linux kernel, the following vulnerability has been resolved: inetpeer: randomize RB-tree node comparison using SipHash The inetpeer rate limiting system stores peer entries in a Red-Black tree keyed deterministically on the remote IP address. Because tree lookups walk the RB-tree using...

CVE-2026-90111

In the Linux kernel, the following vulnerability has been resolved: ip6mr: do not clone dst in ip6mrcachereport IPv6 input attaches a non-refcounted NOREF dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mrcacheunresolved places the skb onto the unresolved queue,...

EUVD-2026-81702

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...

CVE-2026-90109

CVE-2026-90109 is a 32-bit integer overflow in the Linux kernel network scheduling subsystem, affecting the gred , bfifo , and plug qdisc enqueue paths. The backlog and packet-length sum is computed in u32 , wrapping at 2³² (4 GiB) . Once the true backlog exceeds this threshold, the wrapped sum a...

CVE-2026-90109 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...

CVE-2026-90109 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...

CVE-2026-90109

In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...

CVE-2026-90107 net/smc: free pending qentry in smc_llc_flow_stop() before memset

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

CVE-2026-90107

CVE-2026-90107 is a memory leak in the Linux kernel's SMC (Shared Memory Communications) module, specifically in smc_llc_flow_stop(). A blind memset zeroes the flow struct without first freeing a potentially non-NULL flow->qentry pointer. The leak is triggered when a late-arriving duplicate CO...

CVE-2026-90108

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...