EUVD-2026-86816

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97963

The Linux kernel contains a vulnerability in the stmmac driver where the ptp_lock (an rwlock) is only initialized during __stmmac_open(). Because the lock is accessed by stmmac_get_time() during tc_taprio_configure() even when the interface is down and never opened, using the uninitialized lock r...

CVE-2026-97962

The Linux kernel contains a vulnerability in the net/mlx5e driver where the representor vnic devlink health reporter is created and destroyed along a path not serialized by the devlink instance lock. This lack of serialization triggers a devl_assert_locked() splat during driver unbind. The issue ...

CVE-2026-97962

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97963

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptplock at probe time priv-ptplock is only initialized in stmmacptpregister, which runs during stmmacopen. However, the lock is also used while the interface is down and has never been opened:...

CVE-2026-97963 net: stmmac: initialize ptp_lock at probe time

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: initialize ptplock at probe time priv-ptplock is only initialized in stmmacptpregister, which runs during stmmacopen. However, the lock is also used while the interface is down and has never been opened:...

CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97962 net/mlx5e: Move representor vnic reporter to eswitch devlink port

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Move representor vnic reporter to eswitch devlink port The representor vnic devlink health reporter is created and destroyed along the representor netdev unload path, which is not serialized by the devlink instance loc...

CVE-2026-97959 net/sched: cls_route: free emptied bucket on filter move

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959

The Linux kernel contains a memory leak vulnerability in the net/sched: cls_route component. When an existing filter is moved to a different top-level bucket via route4_change, the filter is unlinked from the old bucket, but the bucket is never freed. This results in stale empty buckets remaining...

EUVD-2026-86813

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97959 net/sched: cls_route: free emptied bucket on filter move

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97958 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97958

The Linux kernel is vulnerable to a CPU hogging issue in net/sched: cls_api due to how tc_ctl_chain() handles repeated RTM_GETCHAIN requests. If a netlink socket sends these requests without consuming the responses, netlink_attachskb() may return -EAGAIN when the receive buffer is full, causing t...

CVE-2026-97957

In the Linux kernel, the following vulnerability has been resolved: net: hinic: fix mailbox segment buffer overflow checkmboxseqidandseglen validates that seqid does not exceed SEQIDMAXVAL 42 and seglen does not exceed MBOXSEGLEN 48. However, this allows the last segment seqid=42 to carry a full...

CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97958 net/sched: cls_api: Don't replay RTM_GETCHAIN in tc_ctl_chain().

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97956

In the Linux kernel, the following vulnerability has been resolved: net: netfailover: Fix the deadlock in netfailoverslavenamechange This is a sibling fix of commit b84c5632c7b3 "net: netfailover: Fix the deadlock in slave register". There is netdevlockops in the upper callers, so using netifopen...

CVE-2026-97955 net: mana: restore the XDP program pointer when pre-allocation fails

In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails manaxdpset publishes the new program into apc-bpfprog before it allocates anything, because manapreallocrxbufs sizes the buffers from it via managetrxbufcfg. Wh...