ROS-20260925-73-0093

The vulnerability of the p9clientwalk function in the net/9p/client.c module of the 9P protocol implementation in the Linux operating system is related to the dereferencing of a pointer whose validity period has expired. Exploiting this vulnerability allows an attacker to compromise the...

CVE-2026-97962: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

CVE-2026-97953: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...

CVE-2026-98017: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

CVE-2026-98070: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

CVE-2026-97989

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

CVE-2026-97618: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97954: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-98071: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98105: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oatc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with endvalid bit set, before it runs out o...

CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98105

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oatc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with endvalid bit set, before it runs out o...

CVE-2026-98012: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

CVE-2026-98012

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

CVE-2026-98015

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...