CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99059 wireguard: noise: reject response consumption after intermediate initiation

In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two threads begin processing the identical response message, received twice. The first thread, A, runs. While it's running, the second one, B, gets partw...

CVE-2026-99058 workqueue: Fix NULL current_pwq deref in chained work check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

CVE-2026-99058

The Linux kernel contains a vulnerability in the workqueue subsystem where a NULL pointer dereference can occur during a chained work check. The current_wq_worker() function identifies a kworker , but it does not guarantee the worker is actively executing a work item; the worker->current_pwq m...

CVE-2026-99058 workqueue: Fix NULL current_pwq deref in chained work check

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

EUVD-2026-108724

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

CVE-2026-99057

The Linux kernel contains a memory leak vulnerability in the xen/netfront component. When a response chain contains more slots than the skb's frags can accommodate, xennet_fill_frags() returns an error and xennet_poll() moves to an error path. Because the skb being filled is already dequeued from...

CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

CVE-2026-99057 xen/netfront: don't leak the skb when xennet_fill_frags() fails

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

EUVD-2026-108852

In the Linux kernel, the following vulnerability has been resolved: xen/netfront: don't leak the skb when xennetfillfrags fails When a response chain has more slots than fit in the skb's frags, xennetfillfrags returns an error and xennetpoll jumps to its error path. That path moves what's left on...

CVE-2026-99056

The Linux kernel contains a race condition in the strparser component, specifically involving the teardown of the parser. The issue arises because strp_recv calls may still be in-flight when strp_done() is invoked, leading to a potential Use-After-Free (UAF) . This condition primarily affects esp...

CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

EUVD-2026-108851

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99055 tcp: reject net_iov in zerocopy receive mapping hints

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

CVE-2026-99055 tcp: reject net_iov in zerocopy receive mapping hints

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

EUVD-2026-108850

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

CVE-2026-99055

The Linux kernel contains a vulnerability where the can_map_frag() function dereferences a null pointer when processing net_iov fragments during zerocopy receive mapping . Specifically, skb_frag_page() returns NULL for a net_iov, but can_map_frag() fails to handle this, leading to a null-ptr-dere...

EUVD-2026-108849

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...