EUVD-2026-86671

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctpi3cprobe drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to...

CVE-2026-98018

A vulnerability exists in the Linux kernel within the net: mctp: i3c component. The root cause is that mctp_i3c_probe() drops the busdevs_lock prematurely after finding the matching bus. This allows a concurrent I3C_NOTIFY_BUS_REMOVE event to unregister and free the bus netdev before the probe ca...

CVE-2026-98017 net/sched: defer qdisc freeing after failed creation

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

CVE-2026-98016

The Linux kernel contains a use-after-free race condition within the net/mlx5e component, specifically in the sample_restore_put() function. The vulnerability occurs during the concurrent teardown of TC sample rules sharing the same restore context; a thread may re-read restore->count after dr...

EUVD-2026-86669

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

CVE-2026-98015

The Linux kernel contains a use-after-free vulnerability in the net/mlx5: E-Switch component within the mlx5_eswitch_termtbl_put() function. The issue arises because the tt->ref_count cleanup check occurs after the termtbl_mutex has been released, allowing a race condition where one caller fre...

CVE-2026-98014

The Linux kernel contains a vulnerability in the net/mlx5 driver related to E-Switch functionality. During FW-fatal recovery (where dev->state == INTERNAL_ERROR), a failure in esw_update_vport_rx_mode() leaves vport->allmulti_rule intact. This causes esw_update_vport_mc_promisc() to add ent...

EUVD-2026-86668

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

EUVD-2026-86667

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch, prevent mclist repopulation during vport disable In mlx5eswvportdisable, move eswapplyvportrxmode ahead of eswvportchangehandlelocked so vport-allmultirule is NULL before the change handler observes it. During...

CVE-2026-98013

The Linux kernel contains a vulnerability in the net/sched component within the fq_pie qdisc. The fq_pie_change() function improperly accepts any quantum value from userspace, including a value of 1. When combined with a crafted size table where qdisc_pkt_len reaches approximately 2 GiB , a quant...

EUVD-2026-86666

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: clamp quantum in change path fqpiechange accepts any quantum value from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

CVE-2026-98011

The Linux kernel contains a vulnerability in the net/sched: hhf component where the hhf_change() function accepts an unvalidated quantum from userspace. A user with CAP_NET_ADMIN privileges can provide a quantum of 1 combined with a crafted size table to cause the deficit-refill loop to spin appr...

EUVD-2026-86664

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhfchange accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

CVE-2026-98012

The Linux kernel contains a vulnerability in the net/sched: sfq component where the sfq_change() function fails to properly restrict the quantum value. By providing a crafted size table causing qdisc_pkt_len to reach approximately 2 GiB, an attacker can set quantum=1 to trigger a deficit-refill l...

EUVD-2026-86665

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

EUVD-2026-86662

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98009

The Linux kernel contains a vulnerability in the net/sched: ets component where the ets_qdisc_change() function falls back to psched_mtu() without a floor for bands lacking an explicit quantum. An attacker with CAP_NET_ADMIN privileges can use a crafted size table to cause qdisc_pkt_len to reach ...

CVE-2026-98010

The Linux kernel contains a vulnerability in the net/sched subsystem where the drr_change_class() function fails to properly clamp the quantum value during a fallback to psched_mtu(). Specifically, while explicit zeros are rejected, the absence of a floor allows a crafted size table to cause qdis...

EUVD-2026-86663

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drrchangeclass rejects explicit quantum==0 but falls back to pschedmtu with no floor. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 or a zero pschedmtu on a...

CVE-2026-98008

The Linux kernel contains a NULL pointer dereference vulnerability within the net: macb driver. When the device tree describes a fixed-link without an "mdio" child node, the macb_mii_init() function returns early without allocating the MDIO bus, leaving bp->mii_bus as NULL . This causes a kern...