CVE-2026-97960

The Linux kernel is vulnerable to a reentry issue in the perf/x86/intel component. The PEBS buffer is shared by all events on a CPU, meaning drain_pebs() must not be reentered; otherwise, an instance might observe a stale buffer state and potentially access out-of-bound memory . While most calls ...

EUVD-2026-86814

In the Linux kernel, the following vulnerability has been resolved: perf/x86/intel: Prevent drainpebs reentry The PEBS buffer is shared by all events on a CPU, so drainpebs must not be reentered. If so, one instance may observe stale buffer state and potentially access out-of-bound memory. Most...

EUVD-2026-86813

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97957 net: hinic: fix mailbox segment buffer overflow

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

EUVD-2026-86811

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

CVE-2026-97957

The Linux kernel contains a heap buffer overflow vulnerability within the hinic driver. The issue originates in the check_mbox_seq_id_and_seg_len() function, which fails to account for the remaining buffer space when processing the last segment. Specifically, it allows a segment with seq_id=42 to...

EUVD-2026-86812

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97958

The Linux kernel is vulnerable to a CPU hogging issue in net/sched: cls_api due to how tc_ctl_chain() handles repeated RTM_GETCHAIN requests. If a netlink socket sends these requests without consuming the responses, netlink_attachskb() may return -EAGAIN when the receive buffer is full, causing t...

EUVD-2026-86810

In the Linux kernel, the following vulnerability has been resolved: net: netfailover: Fix the deadlock in netfailoverslavenamechange This is a sibling fix of commit b84c5632c7b3 "net: netfailover: Fix the deadlock in slave register". There is netdevlockops in the upper callers, so using netifopen...

CVE-2026-97956

The Linux kernel contains a deadlock vulnerability within the net_failover subsystem, specifically in the net_failover_slave_name_change() function. The issue arises because the function uses dev_open() in contexts where netdev_lock_ops() is present in upper callers, leading to a lock conflict. T...

EUVD-2026-86808

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97954

The Linux kernel contains a vulnerability in the net/rds component where rds_message_map_pages() incorrectly assigns PAGE_SIZE bytes to every scatterlist entry, even for partial pages. On systems with a PAGE_SIZE greater than 8192 bytes, this causes the scatterlist to map bytes beyond the end of ...

EUVD-2026-86809

In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails manaxdpset publishes the new program into apc-bpfprog before it allocates anything, because manapreallocrxbufs sizes the buffers from it via managetrxbufcfg. Wh...

CVE-2026-97955

The Linux kernel contains a vulnerability in the mana networking subsystem where the XDP program pointer is not correctly restored when RX buffer pre-allocation fails. Specifically, mana_xdp_set() publishes a new program into apc->bpf_prog before allocation; if mana_pre_alloc_rxbufs() fails, i...

CVE-2026-97952

A vulnerability exists in the Linux kernel 's sunvdc driver where a failure during __vdc_tx_trigger() causes the driver to fail to unmap LDC cookies . Because the descriptor remains in a READY state and the prod pointer is not advanced, the mapping is never released, leading to a permanent leak o...

CVE-2026-97953 net: stmmac: fix TX descriptor availability check for TSO traffic

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

EUVD-2026-86806

In the Linux kernel, the following vulnerability has been resolved: sunvdc: unmap LDC cookies when the descriptor send fails sendrequest maps the request's pages into the LDC channel's map table ldcmapsg, fills in the descriptor and marks it VIODESCREADY before ringing the doorbell via...

EUVD-2026-86807

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-97953

A vulnerability exists in the Linux kernel 's stmmac driver related to the TX descriptor availability check for TSO traffic . The stmmac_tso_xmit() function incorrectly estimates the required free TX descriptors by assuming the payload is split into TSO_MAX_BUFF_SIZE chunks. This logic underestim...

CVE-2026-97951

The Linux kernel contains a vulnerability in the iSCSI target component where certain aborted WRITE_PENDING commands cause a hang. When a LUN_RESET aborts a WRITE command in the TRANSPORT_WRITE_PENDING state, the target core sets the CMD_T_ABORTED flag and waits for the frontend. If the initiator...