CVE-2026-98800 bpf: Wait for an RCU tasks grace period before freeing trampoline progs

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

EUVD-2026-103885

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

CVE-2026-98799

The Linux kernel contains a vulnerability where bpf_tramp_image_put() fails to prevent the freeing of programs called by a trampoline image while a task is still executing within that image. This occurs because detaching a program drops its reference immediately, leading to its release during gra...

CVE-2026-98799 bpf: Skip detached progs in trampoline images that are still in use

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

EUVD-2026-103884

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

CVE-2026-98798 net: bcmgenet: fix NULL dereference in set_coalesce before first open

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98798

The Linux kernel contains a NULL dereference vulnerability in the bcmgenet driver. The issue occurs because the Rx ring priv and index are only initialized during the open operation. If a user attempts to set Rx coalescing parameters—for example, using ethtool -C eth0 rx-usecs 50—on an interface ...

EUVD-2026-103883

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98797

The Linux kernel is vulnerable to a slab-out-of-bounds error in taprio_enqueue() caused by a stale skb->queue_mapping value. When using skbedit, a nested transmit (such as a mirror or redirect) could set the skip_txqueue flag, which the outer transmit might incorrectly consume. If a forwarded ...

EUVD-2026-103882

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98796

The Linux kernel contains a vulnerability in the mtk_eth_soc driver where the internal "dummy" netdev (used for RX rings and shared NAPI) is allocated and initialized after the MAC netdevs are registered. This creates a race condition window where netdevs are visible to the network core before th...

CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

EUVD-2026-103881

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98795

The Linux kernel contains a vulnerability in the sparx5 driver where unbinding the driver can lead to a NULL pointer dereference . This occurs because sparx5_ptp_init() returns early on certain lan969x variants (due to a missing SPX5_FEATURE_PTP flag) or when no "ptp" interrupt is described, but ...

EUVD-2026-103880

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98794 ipvs: filter some flags received in the backup server

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98794

A vulnerability in the Linux kernel allows the IPVS SYNC protocol to receive messages that could cause issues on the backup server. Specifically, the NO_CPORT+TEMPLATE combination allowed lookups for normal connections to hit templates in unpredictable ways. Additionally, the ONE_PACKET flag was ...

EUVD-2026-103879

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...