CVE-2026-98596 ipv6: Fix dst leak for uncached routes.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98596

The Linux kernel contains a vulnerability where a race condition occurs during the unregistration of a device. Specifically, when rt6_uncached_list_flush_dev() unlinks uncached routes using list_del_init(), a concurrent execution can cause list_empty() to evaluate as true prematurely. This leads ...

CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98595 udp: remove a disconnected socket from the 4-tuple hash table

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

CVE-2026-98595

The Linux kernel contains a vulnerability where a UDP socket bound to a specific address and port fails to remove its entry from the 4-tuple hash table after being disconnected. This occurs because __udp_disconnect() skips necessary rehash or unhash operations when specific locks like SOCK_BINDAD...

EUVD-2026-103640

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...

CVE-2026-98594

The Linux kernel contains a vulnerability where the tg3 driver fails to properly clean up PHYLIB resources during a probe failure. Specifically, if tg3_get_invariants() registers an MDIO bus and connects a PHY for USE_PHYLIB devices, but tg3_init_one() subsequently fails, the common error path re...

EUVD-2026-103639

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...

CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

CVE-2026-98593

The Linux kernel contains a NULL pointer dereference vulnerability in the s390/debug component within the debug_info_copy() function. The issue occurs when debug_register_static() fails, as it clears areas, active_pages, and active_entries while leaving the area bounds unchanged. This causes debu...

EUVD-2026-103638

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

EUVD-2026-103637

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98592

The Linux kernel contains a vulnerability in the spacemit driver. The emac_tx_mem_map() function prematurely writes TX_DESC_0_OWN into ring descriptors before all fragments are successfully mapped. If emac_tx_map_frag() fails, the error path calls emac_free_tx_buf() to unmap buffers but fails to ...

CVE-2026-98591

The Linux kernel contains a vulnerability in the skb_pointer_if_linear() function used by skb-backed BPF dynptr code. The root cause is an unsigned subtraction underflow occurring between skb_headlen and the off parameter. This flaw allows the bounds check to spuriously pass, potentially generati...

EUVD-2026-103636

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

CVE-2026-98591 bpf: Fix bounds check for skb-backed dynptrs

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bounds check for skb-backed dynptrs The skbpointeriflinear function checks whether a memory region of length len starting at offset off into the skb is in the linear area, and returns a pointer to the region if so. The...

EUVD-2026-103635

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix bpfsock context code generation Currently, the ctx access code reads the rxqueuemapping field with either a 4-byte or 2-byte load. The rest of the bits in the register are marked known zero by the verifier. However, the...

CVE-2026-98590

The Linux kernel contains a vulnerability in the bpf_sock context code generation. The issue arises because the ctx access code reads the rx_queue_mapping field using a 4-byte or 2-byte load, but the emitted code uses BPF_MOV_IMM64 for certain special values (like -1). This causes sign-extension,...