CVE-2026-97958: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...

Linux Distros Unpatched Vulnerability : CVE-2026-97959

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the...

Linux Distros Unpatched Vulnerability : CVE-2026-98013

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: fqpie: clamp quantum in change path fqpiechange accepts any quantum value from userspace, including 1. With a crafted size table qdiscpktlen reaches ...

Linux Distros Unpatched Vulnerability : CVE-2026-98026

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: mcast: properly convert mglist to rcu Sashiko reported a bug 1 that brmulticastdelportgroup unlists the port group not using proper rcu helper that...

Linux Distros Unpatched Vulnerability : CVE-2026-97615

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist wh...

Linux Distros Unpatched Vulnerability : CVE-2026-98022

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An...

Linux Distros Unpatched Vulnerability : CVE-2026-97973

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees...

CVE-2026-98012: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

CVE-2026-97959: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-97973

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff or...

CVE-2026-98070

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire RDSINXMIT in rdstcpresetcallbacks rdstcpresetcallbacks quiesces the transmit path by setting the path state to RDSCONNRESETTING and then waiting for RDSINXMIT to be sampled clear before swapping the underlying...

CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

CVE-2026-98104

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: fix duplicate handle when node ID pool is exhausted gennewkid falls back to returning max htid | 0xFFF when both idrallocu32 ranges are full, instead of reporting an error. u32change trusts that value and inser...

CVE-2026-97614

In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...

CVE-2026-98072

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in releaseinxmit releaseinxmit clears RDSINXMIT with clearbitunlock and then checks waitqueueactive to decide whether anyone needs waking. clearbitunlock is only a release operation: it orders the critic...

CVE-2026-98012

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum in change path sfqchange accepts any non-negative quantum only rejects intctl-quantum 120 with -EINVAL, matching fqcodelchange and the init clamp. Conditions to recreate the bug: CONFIGNETSCHSFQ=y...

CVE-2026-97613

In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...

CVE-2026-98069

In the Linux kernel, the following vulnerability has been resolved: net/rds: acquire the fastpath locks in rdsconnshutdown rdsconnshutdown quiesces the transmit and receive-refill paths by waiting for RDSINXMIT and RDSRECVREFILL to be sampled clear, and then runs the transport shutdown and...

CVE-2026-98009

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: clamp quantum in parse and fallback paths etsqdiscchange falls back to pschedmtu with no floor for bands without an explicit quantum. With a crafted size table qdiscpktlen reaches 2 GiB, so a zero pschedmtu on a...

CVE-2026-98131

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix dma mapping leak in stmmactsoxmit In stmmactsoxmit, if the DMA mapping of an skb fragment fails, the frame is dropped but the DMA mappings already created for the linear part and for the fragments mapped before t...