CVE-2026-98852

In the Linux kernel, the following vulnerability has been resolved: net: extend IPv6 exthdr detection of tunneled packets Commit c4336a07eb6b "net: correctly handle tunneled traffic on IPV6CSUM GSO fallback" split skbgsohasextensionhdr into mutually exclusive branches on skb-encapsulation. This d...

EUVD-2026-103790

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850 net/packet: prevent TX_RING byte count overflow

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850 net/packet: prevent TX_RING byte count overflow

In the Linux kernel, the following vulnerability has been resolved: net/packet: prevent TXRING byte count overflow tpacketsnd drains every SENDREQUEST frame in a TX ring and adds each valid packet length to the signed int lensum. Userspace can recycle completed frames concurrently, so a single...

CVE-2026-98850

The Linux kernel contains a vulnerability in net/packet where the tpacket_snd() function fails to bound the len_sum variable. Because userspace can recycle completed frames concurrently, len_sum can wrap into a negative range after sufficient transmissions. Specifically, certain frame sizes can p...

CVE-2026-98812

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

EUVD-2026-103897

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98812

A vulnerability exists in the Linux kernel 's net/mctp component where the mctp_add_dev() function incorrectly links a new mctp_dev into dev->mctp_ptr before the mdev->dev pointer is assigned. This race condition allows a reader to pick up the device in a window where it still points to NUL...

CVE-2026-98812 net/mctp: publish the mctp_dev only after it is initialised

In the Linux kernel, the following vulnerability has been resolved: net/mctp: publish the mctpdev only after it is initialised mctpadddev links the new mctpdev into dev-mctpptr before mdev-dev is assigned, so a reader that picks the device up in that window dereferences a netdevice pointer that i...

CVE-2026-98811

The Linux kernel contains a vulnerability in the net/sched: cls_api component where a race condition between two concurrent tc filter add requests on the same chain/priority of an unlocked classifier can cause an empty proto to remain linked in the chain. This occurs when both requests fail: the ...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98811 net/sched: cls_api: reclaim an empty proto on the error path

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

EUVD-2026-103896

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: reclaim an empty proto on the error path Two racing tc filter add requests on the same chain/prio of an unlocked classifier both run change on the shared proto and both can fail: the winner's...

CVE-2026-98808

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

EUVD-2026-103893

In the Linux kernel, the following vulnerability has been resolved: net: systemport: Fix buffer overflow in bcmsysportgetstats When running on SYSTEMPORT Lite, certain statistics are unsupported and skipped during bcmsysportgetstats. The variable 'j' tracks the compacted index into the destinatio...

CVE-2026-98807

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...

CVE-2026-98807 net/mlx5: Fix slab-out-of-bounds when handling team device events

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: Fix slab-out-of-bounds when handling team device events The mlx5handlechangeupperevent and mlx5handlechangeinfodataevent functions check for LAG masters which includes both bonding and team devices but only call...