CVE-2026-98550

The Linux kernel contains a vulnerability in the tipc transport protocol where an incomplete check on GRP_ACK_MSG allows for bc_ackers underflow. Specifically, if grp->bc_ackers is zero, an unexpected ACK with a higher sequence number can wrap the 16-bit counter to 65535, causing tipc_group_bc...

EUVD-2026-103595

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

EUVD-2026-103594

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549

A vulnerability in the Linux kernel TCP stack allows skbs to be improperly collapsed across a boundary in the rtx queue . The issue occurs because tcp_write_collapse_fence() can be a no-op if the sk_write_queue is empty, leading tcp_retrans_try_collapse() or tcp_shift_skb_data() to merge new skbs...

CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98548

The Linux kernel contains a use-after-free vulnerability in the SCTP protocol implementation. When an association is in the COOKIE-ECHOED state and receives a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address, the system processes the ERROR chunk via sctp_sf_do_5_2_6_stale(). ...

EUVD-2026-103593

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

EUVD-2026-103592

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98547

The Linux kernel is vulnerable to an integer overflow in the prb_calc_retire_blk_tmo() function within the af_packet component. The vulnerability occurs because the function performs 32-bit arithmetic when calculating mbits. A user-controlled tp_block_size (e.g., 256MiB) can cause the calculation...

CVE-2026-98546 arm64/boot: Disable trapping of PMZR_EL0 writes to EL2

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98546

The Linux kernel is affected by a vulnerability in the arm64/boot component. The root cause is located in __init_el2_fgt2(), which incorrectly writes a single mask to both HDFGRTR2_EL2 and HDFGWTR2_EL2 . Because PMZR_EL0 is write-only, its trap bit (nPMZR_EL0 ) is never set, causing a PMZR_EL0 wr...

EUVD-2026-103591

In the Linux kernel, the following vulnerability has been resolved: arm64/boot: Disable trapping of PMZREL0 writes to EL2 initel2fgt2 writes one mask to both HDFGRTR2EL2 and HDFGWTR2EL2. PMZREL0 is write-only, so its trap bit, nPMZREL0, exists only in HDFGWTR2EL2 and is therefore never set: a...

CVE-2026-98545 ata: libata-scsi: bound the ATA passthru sense descriptor writes

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

EUVD-2026-103590

In the Linux kernel, the following vulnerability has been resolved: ata: libata-scsi: bound the ATA passthru sense descriptor writes When an ATA PASS-THROUGH command to an ATAPI device fails, the sense buffer holds the device's REQUEST SENSE reply, and atascsisetpassthrusensefields trusts its...

CVE-2026-98545

The Linux kernel is vulnerable to an out-of-bounds read and write in the libata-scsi component. Specifically, when an ATA PASS-THROUGH command to an ATAPI device fails, the ata_scsi_set_passthru_sense_fields() function incorrectly trusts the additional length byte (sb[7] ) of the REQUEST SENSE re...

CVE-2026-98544 bna: prevent IOC timer rearm during teardown

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

EUVD-2026-103589

In the Linux kernel, the following vulnerability has been resolved: bna: prevent IOC timer rearm during teardown bna: prevent IOC timer rearm during teardown bnadpciremove and the probe disableioceth path call timerdeletesync for ioctimer, semtimer and hbtimer, but not for iocpftimer...

CVE-2026-98544

The Linux kernel contains a vulnerability where the bnad_pci_remove() and probe disable_ioceth paths fail to properly handle the iocpf_timer . While other timers are removed via timer_delete_sync() , the iocpf_timer remains active, leading bnad_iocpf_timeout() to attempt to take the bnad->bna_...