CVE-2026-98793

The Linux kernel contains a vulnerability in the netfilter component where the function bpf_ct_set_nat_info() fails to validate the NAT manipulation type. This allows an incorrect value to be passed to nf_nat_setup_info(), triggering a WARN_ON() signal. If panic_on_warn is not set, the system set...

CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

EUVD-2026-103878

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98792

The Linux kernel contains a vulnerability in the netfilter flowtable component where the nf_flow_offload_stats() function can schedule work to retrieve statistics while a flow is simultaneously being removed by the GC (Garbage Collection) . This issue can lead to a race condition between the GC a...

CVE-2026-98792 netfilter: flowtable: generalize pending status bit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

EUVD-2026-103877

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98791

The Linux kernel contains a vulnerability in the net/mlx5e driver. During XSK TX queue teardown , outstanding descriptors are completed without a Completion Queue Entry (CQE). If a requested TX timestamp is missing, the completion path passes a NULL CQE to the mlx5e_xsk_fill_timestamp() function,...

EUVD-2026-103876

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

EUVD-2026-103875

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98790

The Linux kernel contains a race condition between perf_event_exit_task() and perf_pending_task() during the begin_new_exec() process. This occurs because perf_event_exit_task() may be called while the PF_EXITING flag is not yet set, causing perf_sigtrap() to continue execution and trigger a WARN...

CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98789

The Linux kernel contains a vulnerability in the BPF subsystem where objects can become stuck in free_by_rcu_ttrace . This occurs because do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set, leaving objects in the trace buffer. Since the number of such objects is not bounde...

EUVD-2026-103874

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

CVE-2026-98788 futex: Fix private hash use-after-free on resize

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98788

The Linux kernel is affected by a use-after-free vulnerability in the futex subsystem during hash table resizing. The root cause is that __futex_pivot_hash() assigns mmph->batches before mmph->hash, allowing futex_ref_drop() to proceed while a reader still holds a pointer to the old hash if...

EUVD-2026-103873

In the Linux kernel, the following vulnerability has been resolved: futex: Fix private hash use-after-free on resize pollstatesynchronizercumm-futex.phash.batches is used by futexrefdrop to check that a grace period has passed since the current hash was published. This relies on batches referenci...

CVE-2026-98787

The Linux kernel contains a vulnerability in the bpf subsystem due to missing migration protection in __rhtab_map_lookup_and_delete_batch() . The function calls bpf_mem_cache_free_rcu() , which utilizes this_cpu_ptr() ; however, unlike other callers of rhtab_delete_elem() , it only uses rcu_read_...

EUVD-2026-103872

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix missing migration protection in rhtabmaplookupanddeletebatch bpfmemcachefreercu uses thiscpuptr which requires migration to be disabled. All callers of rhtabdeleteelem disable migration except rhtabmaplookupanddeletebatc...