EUVD-2026-103889

In the Linux kernel, the following vulnerability has been resolved: net: pagepool: fix use-after-free in pagepoolrecycleringbulk With CONFIGPAGEPOOLSTATS=y, pagepoolrecycleringbulk updates the recycle stats after dropping the producer lock. If it just recycled the last inflight netmems of a pool...

EUVD-2026-103888

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

CVE-2026-98803 net: stmmac: fix rx Scatter-Gather support

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix rx Scatter-Gather support When a received frame is larger than dmabufsz, the DMA scatters it across multiple RX descriptors rx Scatter-Gather. The secondary RX buffer secpage was only allocated and programmed whe...

CVE-2026-98803

The Linux kernel contains a vulnerability in the stmmac driver where received frames larger than dma_buf_sz were not correctly handled for regular frames lacking split-header (SPH) active. Specifically, the secondary RX buffer (buffer2 ) was neither allocated nor mapped, causing the DMA to write ...

CVE-2026-98802 seg6: ensure packet data is writable before modifying SRH and IPv6 DA

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

CVE-2026-98802

A vulnerability exists in the Linux kernel where the functions advance_nextseg() and seg6_next_csid_advance_arg() modify the SRH Segments Left field and the IPv6 destination address without first verifying if the packet data is writable. This issue occurs because the socket buffer (skb) may be sh...

EUVD-2026-103887

In the Linux kernel, the following vulnerability has been resolved: seg6: ensure packet data is writable before modifying SRH and IPv6 DA advancenextseg modifies the SRH Segments Left field and the IPv6 destination address without ensuring the packet data is writable. seg6nextcsidadvancearg has t...

CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...

CVE-2026-98801

The Linux kernel contained a vulnerability where the SO_RESERVE_MEM socket option was improperly handled for UDP sockets . Because the kernel only checked for account ownership rather than protocol type, concurrent UDP packet reception and memory reservation calls could cause race conditions , le...

EUVD-2026-103886

In the Linux kernel, the following vulnerability has been resolved: net: restrict SORESERVEMEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 "net: add new socket option SORESERVEMEM" and commit d00c8ee31729 "net: fix possible NULL deref in sockreservememory" only checked skhasaccountsk,...

EUVD-2026-103885

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

CVE-2026-98800 bpf: Wait for an RCU tasks grace period before freeing trampoline progs

In the Linux kernel, the following vulnerability has been resolved: bpf: Wait for an RCU tasks grace period before freeing trampoline progs When a prog is detached from a trampoline, it is freed after an RCU grace period, or an RCU tasks trace one if it is sleepable. This covers the tasks that ar...

CVE-2026-98800

The Linux kernel contains a vulnerability where programs linked to a trampoline can be freed prematurely when detached. Specifically, on a preemptible kernel , a task preempted in the trampoline just before the enter helper may call the program after it has been freed, leading to a vmalloc-out-of...

CVE-2026-98799 bpf: Skip detached progs in trampoline images that are still in use

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

CVE-2026-98799

The Linux kernel contains a vulnerability where bpf_tramp_image_put() fails to prevent the freeing of programs called by a trampoline image while a task is still executing within that image. This occurs because detaching a program drops its reference immediately, leading to its release during gra...

EUVD-2026-103884

In the Linux kernel, the following vulnerability has been resolved: bpf: Skip detached progs in trampoline images that are still in use bpftrampimageput makes sure a trampoline image is not freed while a task may still be running in it, but nothing similar is done for the progs called by that...

CVE-2026-98798 net: bcmgenet: fix NULL dereference in set_coalesce before first open

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98798

The Linux kernel contains a NULL dereference vulnerability in the bcmgenet driver. The issue occurs because the Rx ring priv and index are only initialized during the open operation. If a user attempts to set Rx coalescing parameters—for example, using ethtool -C eth0 rx-usecs 50—on an interface ...

EUVD-2026-103883

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix NULL dereference in setcoalesce before first open The Rx ring priv and index are only set in bcmgenetinitrxring, which runs at open. Setting the Rx coalescing parameters on an interface that was never opened,...

CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...