CVE-2026-98643

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98643

The Linux kernel is vulnerable to an out-of-bounds read within the bpf subsystem. Specifically, a sockops program reading skops->rtt_min fails to verify the socket type. On the tcp_conn_request() path, sock_ops->sk is a request_sock (non-full), but the context rewrite incorrectly casts it t...

CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

CVE-2026-98643 bpf: Fix out-of-bounds read of rtt_min in sock_ops

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

EUVD-2026-103557

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix out-of-bounds read of rttmin in sockops A sockops prog reading skops-rttmin never checks the sk type: on the tcpconnrequest path sockops-sk is a requestsock non-full, and the ctx rewrite casts it to a tcpsock full and...

EUVD-2026-103545

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98631

The Linux kernel contains a vulnerability in the xsk component within the xsk_map_gen_lookup() function. The root cause is the use of BPF_JMP_IMM to compare a 32-bit key against max_entries. Because BPF immediates are sign-extended to 64 bits, a max_entries value of 0x80000000 or higher creates a...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98631 xsk: Use a 32-bit compare in xsk_map_gen_lookup

In the Linux kernel, the following vulnerability has been resolved: xsk: Use a 32-bit compare in xskmapgenlookup xskmapgenlookup loads a u32 key and compares it with maxentries using BPFJMPIMM. BPF immediates are sign-extended to 64 bits, so a maxentries value of 0x80000000 or higher becomes a...

CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

EUVD-2026-103668

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

CVE-2026-98623

The Linux kernel contains a vulnerability in the drm/nouveau/clk component within the nvkm_clk_ustate_update function. The root cause is a use-after-loop error where the code fails to validate if a pointer is valid after a list_for_each_entry() loop completes without hitting a break. This allows ...

CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

CVE-2026-98612

The Linux kernel contains a vulnerability in the net: usb: catc component within the catc_rx_done() function. The root cause is an improper bound check where pkt_len > urb->actual_length ignores the header offset and compares against the entire transfer instead of the remaining bytes. This ...

CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done()

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

CVE-2026-98612 net: usb: catc: bound the RX packet length in catc_rx_done()

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

EUVD-2026-103657

In the Linux kernel, the following vulnerability has been resolved: net: usb: catc: bound the RX packet length in catcrxdone catcrxdone walks a multi-packet URB, reading a two-byte length from each packet header. Its bound, pktlen urb-actuallength, ignores the header offset and compares against t...

EUVD-2026-103656

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98611 bpf: Check params size before reading reserved fields

In the Linux kernel, the following vulnerability has been resolved: bpf: Check params size before reading reserved fields bpfcryptoctxcreate is a kfunc whose second argument is declared with the sz annotation, so the verifier only guarantees that paramssz bytes of params are valid. The function...

CVE-2026-98611

The Linux kernel contains a vulnerability in the bpf subsystem where the bpf_crypto_ctx_create() kfunc fails to properly validate the size of the second argument. Because the function reads params->reserved[0] and params->reserved[1] (offsets 14 and 15) before comparing params__sz against t...