CVE-2026-98272

A flaw was found in the Linux kernel's Marvell mvpp2 network driver. This vulnerability can lead to a Denial of Service DoS due to an out-of-bounds memory access. A local user with network configuration privileges can trigger this issue by altering the Maximum Transmission Unit MTU, which causes...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

kernel: nvmet-rdma: handle inline data with a nonzero offset

A flaw was found in the nvmet-rdma component of the Linux kernel. This vulnerability arises from incorrect handling of inline data with a non-zero offset, which can lead to an integer underflow. An attacker could exploit this to cause the system to read beyond its allocated memory, potentially...

CVE-2026-98262

A flaw was found in the Linux kernel's libahci driver. This issue can lead to a Denial of Service DoS when initializing storage controllers configured to use 32-bit Direct Memory Access DMA. Because the driver fails to clear the upper 32-bit memory address registers on hardware that physically...

CVE-2026-98201

A flaw was found in the Linux kernel's input subsystem. When handling 32-bit compatibility requests for force feedback input effects, the kernel fails to properly initialize memory buffers before copying data from user space. A local user can exploit this vulnerability to read uninitialized kerne...

CVE-2026-98224

A flaw was found in the Linux kernel's memory management subsystem. A local user could cause a Denial of Service DoS by triggering a failure during a memory mapping preparation operation. Because the kernel fails to properly release accounted memory when this operation fails, repeated triggers ca...

CVE-2026-98303

A flaw was found in the Linux kernel's IPv4 networking subsystem. When looking up routes to send Internet Control Message Protocol ICMP error messages, the kernel fails to properly reject unreachable input routes. A remote attacker can exploit this flaw by transmitting network packets that trigge...

EUVD-2026-95539

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...

CVE-2026-98384

The Linux kernel contains an out-of-bounds read vulnerability in the bpf subsystem within the bpf_sock_destroy() function. The issue arises because the code attempts to read sk_protocol from a sock structure; however, for timewait or request sockets handed to the function by the tcp iterator, thi...

CVE-2026-98384 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...

CVE-2026-98384 bpf: Fix out-of-bounds read of sk_protocol in bpf_sock_destroy()

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...

CVE-2026-98384

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of skprotocol in bpfsockdestroy skprotocol lives in struct sock, not in struct sockcommon. A timewait or request sock handed to bpfsockdestroy by the tcp iterator is neither, so reading sk-skprotocol...

EUVD-2026-95538

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfskbpulldata for LWTSEG6LOCAL An LWTSEG6LOCAL program can invalidate its cached SRH with bpflwtseg6adjustsrh and then call bpfskbpulldata. The latter may reallocate skb-head, leaving the per-CPU SRH pointer...

CVE-2026-98383 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfskbpulldata for LWTSEG6LOCAL An LWTSEG6LOCAL program can invalidate its cached SRH with bpflwtseg6adjustsrh and then call bpfskbpulldata. The latter may reallocate skb-head, leaving the per-CPU SRH pointer...

CVE-2026-98383

The Linux kernel contains a vulnerability where an LWT_SEG6LOCAL program can invalidate its cached SRH using bpf_lwt_seg6_adjust_srh() and subsequently call bpf_skb_pull_data(). This sequence can cause skb->head to be reallocated, resulting in a dangling per-CPU SRH pointer . Subsequent post-p...

CVE-2026-98383

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfskbpulldata for LWTSEG6LOCAL An LWTSEG6LOCAL program can invalidate its cached SRH with bpflwtseg6adjustsrh and then call bpfskbpulldata. The latter may reallocate skb-head, leaving the per-CPU SRH pointer...

CVE-2026-98383 bpf: Disallow bpf_skb_pull_data() for LWT_SEG6LOCAL

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfskbpulldata for LWTSEG6LOCAL An LWTSEG6LOCAL program can invalidate its cached SRH with bpflwtseg6adjustsrh and then call bpfskbpulldata. The latter may reallocate skb-head, leaving the per-CPU SRH pointer...

EUVD-2026-95537

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98382 bpf: Reject dev-bound-only programs on other devices

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject dev-bound-only programs on other devices bpfoffloaddevmatch falls back to comparing offdev pointers after an exact netdev mismatch. Bound-only programs normally have NULL offdevs, so unrelated netdevs compare equal. A...

CVE-2026-98381 veth: manage XDP program pointers during channel resize

In the Linux kernel, the following vulnerability has been resolved: veth: manage XDP program pointers during channel resize vethsetchannels tears down XDP resources for removed RX queues without clearing rq-xdpprog. If the program is then detached or replaced, those queues keep the old pointer...