CVE-2026-97984

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IP6MAXMTU for UDP sockets to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockop...

CVE-2026-97988

In the Linux kernel, the following vulnerability has been resolved: vhost: invalidate vring access on IOTLB transitions When VIRTIOFACCESSPLATFORM changes, cached vring pointers and IOTLB metadata are interpreted in a different address space. Keeping them across the transition can leave stale rin...

CVE-2026-98071

In the Linux kernel, the following vulnerability has been resolved: net/rds: clear cpflags bits individually in rdsconnpathreset rdsconnpathreset wipes the whole flag word with a plain cp-cpflags = 0 store. Every other accessor of that word uses atomic bitops, and some of them can run concurrentl...

CVE-2026-98016

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

CVE-2026-97973

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff or...

CVE-2026-97982

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...

CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-97615

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

CVE-2026-97614

In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...

CVE-2026-98069

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

CVE-2026-97958

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

CVE-2026-98072

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

CVE-2026-98012

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

ROS-20260925-73-0093

The vulnerability of the p9clientwalk function in the net/9p/client.c module of the 9P protocol implementation in the Linux operating system is related to the dereferencing of a pointer whose validity period has expired. Exploiting this vulnerability allows an attacker to compromise the...

CVE-2026-98099

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: use rcuassignpointer for rcu list updates Several places in net/ipv6/mcast.c update RCU-protected lists np-ipv6mclist, idev-mclist, idev-mctomb using direct pointer assignments instead of rcuassignpointer: 1. In...

CVE-2026-98131

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...

CVE-2026-98105

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oatc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with endvalid bit set, before it runs out o...

CVE-2026-97989

In the Linux kernel, the following vulnerability has been resolved: vduse: validate virtqueue alignment vdusevalidateconfig only checks the upper bound of vqalign. Invalid values can therefore reach vringcreatevirtqueuemap. The split-ring helpers use align - 1 as a bit mask, so the alignment must...

CVE-2026-98070

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...