CVE-2026-90107

CVE-2026-90107 is a memory leak in the Linux kernel's SMC (Shared Memory Communications) module, specifically in smc_llc_flow_stop(). A blind memset zeroes the flow struct without first freeing a potentially non-NULL flow->qentry pointer. The leak is triggered when a late-arriving duplicate CO...

CVE-2026-90107 net/smc: free pending qentry in smc_llc_flow_stop() before memset

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

CVE-2026-90108 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...

CVE-2026-90108

CVE-2026-90108 is a memory leak in the Linux kernel 's net/smc subsystem. When smc_llc_event_handler() transitions the local LLC flow from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK, it overwrites flow->qentry via smc_llc_flow_qentry_set() without first freeing a previously stashed ent...

EUVD-2026-81700

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

EUVD-2026-81701

In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...

CVE-2026-90107 net/smc: free pending qentry in smc_llc_flow_stop() before memset

In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...

CVE-2026-90099 net/sched: account classifier filter allocations to memcg

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

CVE-2026-90099 net/sched: account classifier filter allocations to memcg

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

EUVD-2026-81960

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

CVE-2026-90099

CVE-2026-90099 affects the Linux kernel's net/sched (traffic control) subsystem. Allocations in tc classifier *_change() paths use GFP_KERNEL without __GFP_ACCOUNT , allowing unprivileged users in a user+network namespace to pin kernel memory outside memcg charging by creating large numbers of tc...

EUVD-2026-81942

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

CVE-2026-90065

CVE-2026-90065 affects the Linux kernel 's net/smc subsystem. When an IPPROTO_SMC socket creation fails after the proto->init hook has run (e.g., a cgroup BPF program at BPF_CGROUP_INET_SOCK_CREATE denies the socket), neither smc_inet_prot nor smc_inet6_prot defines a .destroy hook, so the int...

CVE-2026-90065 net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock "clcsock" from the proto-init hook. When socket creation fails after proto-init has run - e.g. a cgroup B...

CVE-2026-90065 net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock "clcsock" from the proto-init hook. When socket creation fails after proto-init has run - e.g. a cgroup B...

EUVD-2026-81924

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

CVE-2026-90063 virtio-net: Ensure that TCP packets don't overflow gso_segs

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

CVE-2026-90063

CVE-2026-90063 is a vulnerability in the Linux kernel's virtio-net driver. A user can specify a gso_size smaller than 8 (below TCP_MIN_GSO_SIZE) in a packet crafted via an AF_PACKET PACKET_VNET_HDR socket. Because GSO_MAX_SIZE equals 8 × 65535, dividing the SKB length by a gso_size

CVE-2026-90063 virtio-net: Ensure that TCP packets don't overflow gso_segs

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

CVE-2026-90058 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...