UBUNTU-CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

UBUNTU-CVE-2026-98015

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

UBUNTU-CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

UBUNTU-CVE-2026-98069

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

UBUNTU-CVE-2026-97612

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

UBUNTU-CVE-2026-97616

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

UBUNTU-CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

UBUNTU-CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

UBUNTU-CVE-2026-98072

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

UBUNTU-CVE-2026-97618

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

UBUNTU-CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

UBUNTU-CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

UBUNTU-CVE-2026-97613

In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...

UBUNTU-CVE-2026-98010

In the Linux kernel, the following vulnerability has been resolved: net/sched: drr: clamp quantum in change class drrchangeclass rejects explicit quantum==0 but falls back to pschedmtu with no floor. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 or a zero pschedmtu on a...

UBUNTU-CVE-2026-97953

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

UBUNTU-CVE-2026-97982

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...

UBUNTU-CVE-2026-97973

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff or...

UBUNTU-CVE-2026-97963

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptplock at probe time priv-ptplock is only initialized in stmmacptpregister, which runs during stmmacopen. However, the lock is also used while the interface is down and has never been opened:...

UBUNTU-CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

UBUNTU-CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...