CVE-2026-98068: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

CVE-2026-98071: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-97959: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

ROS-20260925-73-0028

The vulnerability of the BPFCALL4 function in the net/core/filter.c module related to the execution of kernel network functions in Linux operating systems involves a pointer shift beyond the allocated memory range. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-97972: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: macb: put the "mdio" child node reference on success macbmiiinit holds the reference returned by ofgetchildbyname for macbmdiobusregister and drops it only on the error paths, so every successful probe leaks a node reference...

CVE-2026-98104: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

CVE-2026-97616: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...

CVE-2026-98018: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctpi3cprobe drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to...

CVE-2026-97618: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...

CVE-2026-97612: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: mpls: clear innerprotocol when the last label is popped skbmplspush records the pre-encapsulation network header once, gated on !skb-innerprotocol. skbmplspop never clears that record, so it outlives the encapsulation it...

CVE-2026-97954

In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...

CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97939: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

ROS-20260925-73-0043

The vulnerability of the function batadvttpreparetvlvglobaldata in the module net/batman-adv/translation-table.c, which is part of the networking functions of the Linux kernel, is related to state management errors. Exploiting this vulnerability could allow an attacker to compromise the...

ROS-20260925-73-0048

The vulnerability of the batadvttpreparetvlvlocaldata function in the net/batman-adv/translation-table.c module, which is part of the Linux kernel’s networking functions, is related to synchronization errors when using shared resources “Race Conditions”. Exploiting this vulnerability can allow an...

ROS-20260925-73-0025

The vulnerability of the devlinknotifyunregister function in the net/devlink/leftover.c module, which is part of the Linux kernel’s networking functions, is related to the improper generation of crash reports. Exploiting this vulnerability could allow an attacker to compromise the confidentiality...

ROS-20260925-73-0050

The vulnerability of the net/netfilter/xtIDLETIMER.c component in the Linux operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow a attacker to cause a service failure...

ROS-20260925-73-0036

The vulnerability of the ipv4sysctlexitnet function in the net/ipv4/sysctlnetipv4.c module of the IPv4 protocol implementation in Linux’s kernel relates to incomplete cleanup of temporary or auxiliary resources. Exploiting this vulnerability could allow an attacker to compromise the...