CVE-2026-98076

The Linux kernel is vulnerable to a use-after-free issue in the tracing/probes component. The root cause resides in traceprobe_define_arg_fields(), which stores pointers to probe argument name/type strings without copying them. When multiple probes share a dynamic event (kprobe, uprobe, eprobe, o...

EUVD-2026-86906

In the Linux kernel, the following vulnerability has been resolved: tracing/probes: Fix use-after-free on field name/type of events with multiple probes The fields of a probe-based dynamic event kprobe, uprobe, eprobe and fprobe events are created in traceprobedefineargfields by handing the...

EUVD-2026-86907

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

CVE-2026-98077 netfilter: nf_conntrack_sip: fix OOB read in sip_skip_whitespace()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntracksip: fix OOB read in sipskipwhitespace sipskipwhitespace returns dptr unchanged when its own loop exhausts the buffer dptr == limit, instead of NULL like its sibling sipfollowcontinuation returns on its own...

CVE-2026-98077

The Linux kernel contains an out-of-bounds (OOB) read vulnerability in the netfilter: nf_conntrack_sip component. The root cause is located in the sip_skip_whitespace() function, which fails to return NULL when its loop exhausts the buffer (where dptr == limit). Because the calling function ct_si...

EUVD-2026-86905

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

CVE-2026-98075

The Linux kernel contains a vulnerability where the fixups.c:jit_subprogs() function fails to rewrite BPF_PSEUDO_FUNC loads for the main program when env->subprog_cnt is not greater than 1. This allows a program to reference the main function as a callback (e.g., via bpf_timer_set_callback()),...

CVE-2026-98075 bpf: reject BPF_PSEUDO_FUNC reference to the main program

In the Linux kernel, the following vulnerability has been resolved: bpf: reject BPFPSEUDOFUNC reference to the main program fixups.c:jitsubprogs rewrites BPFPSEUDOFUNC loads to contain real function addresses. This function is invoked from bpfjitsubprogs only when env-subprogcnt 1. Meaning that f...

EUVD-2026-86726

In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in devchangenetnamespace. syzbot reported the warning in cfg80211pernetexit. 0 The repro does the following: 1. create two device in root netns and non-root netns 2. assign the sam...

CVE-2026-98073 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().

In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in devchangenetnamespace. syzbot reported the warning in cfg80211pernetexit. 0 The repro does the following: 1. create two device in root netns and non-root netns 2. assign the sam...

CVE-2026-98074

The Linux kernel contains a vulnerability in the bonding driver where __bond_release_one() prematurely clears bond->curr_active_slave to NULL during bond destruction when releasing all slaves. If a backup slave is released before the active slave, the system fails to call bond_alb_handle_activ...

EUVD-2026-86727

In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curractiveslave prematurely when releasing all slaves When releasing all slaves during bond destruction all == true, bondreleaseone unconditionally clears bond-curractiveslave to NULL in every iteration. If ...

CVE-2026-98073

The Linux kernel contains a vulnerability where conflicting altnames for dying network namespaces are not properly removed in __dev_change_net_namespace(). This issue was reported by syzbot in cfg80211_pernet_exit(). Specifically, when two devices in different network namespaces share the same al...

CVE-2026-98074 bonding: do not clear curr_active_slave prematurely when releasing all slaves

In the Linux kernel, the following vulnerability has been resolved: bonding: do not clear curractiveslave prematurely when releasing all slaves When releasing all slaves during bond destruction all == true, bondreleaseone unconditionally clears bond-curractiveslave to NULL in every iteration. If ...

CVE-2026-98073 net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().

In the Linux kernel, the following vulnerability has been resolved: net: Remove conflicting altnames for dying netns in devchangenetnamespace. syzbot reported the warning in cfg80211pernetexit. 0 The repro does the following: 1. create two device in root netns and non-root netns 2. assign the sam...

EUVD-2026-86725

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

EUVD-2026-86724

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98072

The Linux kernel contains a vulnerability in the net/rds component where the release_in_xmit() function fails to maintain necessary memory ordering. Specifically, it uses clear_bit_unlock() to clear RDS_IN_XMIT, which lacks the full barrier required for a subsequent load of the wait queue head. T...

CVE-2026-98071

The Linux kernel contains a data race in the net/rds component within the rds_conn_path_reset() function. The vulnerability stems from the use of a plain store (cp->cp_flags = 0) to wipe the flag word, while other accessors use atomic bitops concurrently. This race condition can cause updates ...

CVE-2026-98072 net/rds: use wq_has_sleeper() in release_in_xmit()

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...