CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

UBUNTU-CVE-2026-98233

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

UBUNTU-CVE-2026-98235

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

UBUNTU-CVE-2026-98285

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlandel could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

CVE-2026-98235

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

CVE-2026-98240

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

UBUNTU-CVE-2026-98238

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

UBUNTU-CVE-2026-98288

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

UBUNTU-CVE-2026-98301

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

UBUNTU-CVE-2026-98305

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98303

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98234

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...

CVE-2026-98239

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

UBUNTU-CVE-2026-98272

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98272

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98345

In the Linux kernel, the following vulnerability has been resolved: wifi: cfg80211: check IP header size in cfg80211classify8021d A frame that looks like IP can be transmitted, but be too short, so the DS field is read incorrectly: BUG: KMSAN: uninit-value in cfg80211classify8021d+0x99d/0x12b0...

CVE-2026-98275

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmacirq acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this...

UBUNTU-CVE-2026-98302

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

UBUNTU-CVE-2026-98275

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmacirq acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this...