EUVD-2026-108760

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

CVE-2026-98966 bonding: fix the program leak when XDP is replaced

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

CVE-2026-98966

The Linux kernel contained a vulnerability within the bonding module where BPF programs were leaked when XDP was replaced. The issue caused leaked programs to accumulate during propagation series tests. This vulnerability has been resolved by ensuring the kernel releases the reference on the old ...

CVE-2026-98966 bonding: fix the program leak when XDP is replaced

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

CVE-2026-98965

The Linux kernel ICE driver is vulnerable to a race condition due to the use of writel_relaxed() when updating hardware doorbells on arm64 architectures. This function fails to provide the necessary ordering guarantees between normal memory writes (specifically the dql->num_queued update) and ...

CVE-2026-98965 ice: Restore Ordered MMIO Writes for Tx Doorbells

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql-numqueued, is updated by the ICE driver when it invokes netdevtxsentqueue...

EUVD-2026-108759

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql-numqueued, is updated by the ICE driver when it invokes netdevtxsentqueue...

EUVD-2026-108758

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98964 nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98964 nvmet: use the local P2P device on metadata allocation failure

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98964

The Linux kernel contains a vulnerability in the nvmet component where nvmet_req_alloc_p2pmem_sgls() fails to properly handle metadata allocation errors. Specifically, if data allocation succeeds but metadata allocation fails, the out_free_sg function passes req->p2p_dev to pci_p2pmem_free_sgl...

EUVD-2026-108757

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfsuringreadextentendio If all bios finish before btrfsencodedreadregularfillpages returns, it calls btrfsuringreadextentendio and previously returned the I/O status. A negative errno the...

CVE-2026-98963 btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfsuringreadextentendio If all bios finish before btrfsencodedreadregularfillpages returns, it calls btrfsuringreadextentendio and previously returned the I/O status. A negative errno the...

CVE-2026-98963 btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfsuringreadextentendio If all bios finish before btrfsencodedreadregularfillpages returns, it calls btrfsuringreadextentendio and previously returned the I/O status. A negative errno the...

CVE-2026-98963

The Linux kernel contains a vulnerability in the btrfs filesystem. Specifically, if all bios finish before btrfs_encoded_read_regular_fill_pages() returns, the call to btrfs_uring_read_extent_endio() could result in a negative errno . This caused a double free and unlock issue because both btrfs_...

CVE-2026-98962

The Linux kernel contains a vulnerability within the btrfs file system. Specifically, after the btrfs_uring_read_extent() function is called, the code incorrectly jumped to out_acct, causing it to skip the kfree(data->iov) operation. This memory deallocation is only appropriate for the -EIOCBQ...

CVE-2026-98962 btrfs: free iov when btrfs_uring_read_extent() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

EUVD-2026-108756

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98962 btrfs: free iov when btrfs_uring_read_extent() fails

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98961

The Linux kernel contains a vulnerability in the btrfs filesystem related to how locks are handled during io_uring operations. Specifically, in the btrfs_uring_read_extent() function, the system takes an inode shared lock and an extent lock . Previously, a pages-array allocation failure would ret...