EUVD-2026-103734

In the Linux kernel, the following vulnerability has been resolved: net: atl1: fix soft lockup on out-of-range cmbtpdnexttoclean read Same issue as atl1c see the first commit in this series, "net: atl1c: fix soft lockup on out-of-range tpdcons read": the hardware can report an out-of-range...

CVE-2026-98494

The Linux kernel contains a vulnerability where the atl1 component can experience a soft lockup . This occurs because the hardware may report an out-of-range value (0xffff ) for cmb_tpd_next_to_clean while the PCIe link or MAC is resetting. This out-of-range value causes a loop to spin forever. T...

CVE-2026-98493 net: ipconfig: bound DHCP option construction

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

CVE-2026-98493

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

CVE-2026-98493 net: ipconfig: bound DHCP option construction

In the Linux kernel, the following vulnerability has been resolved: net: ipconfig: bound DHCP option construction icdhcpinitoptions appends the hostname option 12, vendor-class option 60 and client-ID option 61 options into the fixed 312-byte bootppkt.exten buffer. Only the client-ID branch check...

CVE-2026-98493

The Linux kernel contains a memory safety vulnerability in the ipconfig component. The function ic_dhcp_init_options() fails to perform proper bounds checking when appending hostname (option 12) and vendor-class (option 60) into the fixed 312-byte bootp_pkt.exten[] buffer, leading to an unbounded...

CVE-2026-98492 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

CVE-2026-98492

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

CVE-2026-98492 net: macb: fix dma_alloc_coherent() leak on macb_alloc() error paths

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix dmaalloccoherent leak on macballoc error paths Fix 3 leaks in macballoc error paths: - Tx buffer allocated but crossing a 4G boundary: Tx leaked. - Rx buffer allocation fails: Tx leaked. - Rx buffer allocated but...

CVE-2026-98492

A memory leak vulnerability exists in the Linux kernel 's macb network driver during the macb_alloc() operation. The issue occurs because the error handling path calls macb_free(bp) , which attempts to free buffers from bp->queues[0] before they have been stored. This results in three specific...

CVE-2026-98491 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98491

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98491 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

EUVD-2026-103731

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98491

A use-after-free (UAF) vulnerability exists in the Linux kernel within the Open vSwitch conntrack subsystem. When network packet buffers (skb ) containing shared unconfirmed connection tracking (ct) entries are cloned, they may be committed with conflicting extensions. This occurs because the fir...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

EUVD-2026-103730

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490

A use-after-free (UAF) vulnerability exists in the Linux kernel 's Open vSwitch conntrack subsystem. The flaw occurs because a raw pointer to the extensions area is added to the expectations list during helper calls. If additional extensions are added via *_ext_add() calls before a connection is ...