UBUNTU-CVE-2026-97615

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

UBUNTU-CVE-2026-97973

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff or...

UBUNTU-CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

UBUNTU-CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

UBUNTU-CVE-2026-98068

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

UBUNTU-CVE-2026-97963

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptplock at probe time priv-ptplock is only initialized in stmmacptpregister, which runs during stmmacopen. However, the lock is also used while the interface is down and has never been opened:...

UBUNTU-CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

UBUNTU-CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

UBUNTU-CVE-2026-98011

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum in change and init paths hhfchange accepts any quantum from userspace, including 1. With a crafted size table qdiscpktlen reaches 2 GiB, so quantum=1 makes the deficit-refill loop spin 2^31 times und...

UBUNTU-CVE-2026-98015

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

UBUNTU-CVE-2026-98030

In the Linux kernel, the following vulnerability has been resolved: net: dsa: bcmsf2: bound the CFP rule dump by the caller's buffer size bcmsf2cfprulegetall walks the whole cfp.unique bitmap into rulelocs without consulting nfc-rulecnt, which is how many entries the caller had room for...

UBUNTU-CVE-2026-98070

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

UBUNTU-CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

UBUNTU-CVE-2026-98051

In the Linux kernel, the following vulnerability has been resolved: net: bcmasp: fix txspbringfull checking same slot cnt times The loop initialised nextindex from intf-txspbindex on every iteration, so incrring always produced the same result and only one slot was ever tested. Move the...

UBUNTU-CVE-2026-97989

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

UBUNTU-CVE-2026-98099

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

UBUNTU-CVE-2026-98016

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

UBUNTU-CVE-2026-98027

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...

UBUNTU-CVE-2026-98105

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oatc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with endvalid bit set, before it runs out o...

CVE-2026-98131 net: stmmac: fix dma mapping leak in stmmac_tso_xmit()

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...