CVE-2026-98046 bpf: Mark bpf_btf_find_by_name_kind() as sleepable

In the Linux kernel, the following vulnerability has been resolved: bpf: Mark bpfbtffindbynamekind as sleepable When bpfbtffindbynamekind finds a type in module BTF, it returns a new BTF object fd through btfnewfd. This reaches anoninodegetfd, which can sleep while allocating or expanding the...

CVE-2026-98022 net: cap tx_queue_len at S16_MAX to prevent oversized ring allocations

In the Linux kernel, the following vulnerability has been resolved: net: cap txqueuelen at S16MAX to prevent oversized ring allocations Several subsystems allocate ring buffers sized by dev-txqueuelen with no upper bound. An unprivileged user via unshare -Urn can set a huge txqueuelen and exhaust...

CVE-2026-98021

The Linux kernel contains a vulnerability where rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len without proper validation. This allows a device created with an oversized txqueuelen (e.g., 500000) to bypass the S16_MAX cap, leading to oversized ring allocations in pfifo_fas...

CVE-2026-98002 iommu/amd: Fix ineffective error check in nested domain allocation

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

CVE-2026-98002

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

EUVD-2026-86655

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

CVE-2026-98002

The Linux kernel contains a vulnerability in the iommu/amd component due to an ineffective error check during nested domain allocation. The function amd_iommu_pdom_id_alloc() returns an int , which can be a negative errno (such as -ENOSPC) if the ID space is exhausted or memory is short. However,...

CVE-2026-98002 iommu/amd: Fix ineffective error check in nested domain allocation

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Fix ineffective error check in nested domain allocation amdiommupdomidalloc returns an int: a domain ID on success, or the negative errno from idaallocrange when the ID space is exhausted or memory is short...

CVE-2026-97955

In the Linux kernel, the following vulnerability has been resolved: net: mana: restore the XDP program pointer when pre-allocation fails manaxdpset publishes the new program into apc-bpfprog before it allocates anything, because manapreallocrxbufs sizes the buffers from it via managetrxbufcfg. Wh...

CVE-2026-97920

In the Linux kernel, the following vulnerability has been resolved: tracing: Keep the entry count when the histogram stats allocation fails printentries uses nentries both as the number of sort entries and as its own return value, so the -ENOMEM it stores when the stats allocation fails overwrite...

CVE-2026-97598

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97573

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

CVE-2026-97573 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

CVE-2026-97573

The Linux kernel contains a vulnerability in the bnxt_en driver. The function bnxt_rx_ring_reset() fails to properly handle memory allocation errors when reallocating ring buffers. Specifically, bnxt_alloc_one_rx_ring() can return -ENOMEM during bnxt_alloc_one_tpa_info_data(), leaving the rxr-&gt...

EUVD-2026-86881

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

CVE-2026-97573 bnxt_en: Handle buffer allocation failure in bnxt_rx_ring_reset()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle buffer allocation failure in bnxtrxringreset bnxtrxringreset frees the ring buffers and then reallocates them, ignoring the result. bnxtalloconerxring can fail in bnxtalloconetpainfodata, which returns -ENOMEM on t...

EUVD-2026-86879

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...

CVE-2026-97571

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...

CVE-2026-97571 bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...

CVE-2026-97571 bnxt_en: Propagate TPA buffer allocation failures in bnxt_queue_mem_alloc()

In the Linux kernel, the following vulnerability has been resolved: bnxten: Propagate TPA buffer allocation failures in bnxtqueuememalloc bnxtalloconetpainfodata returns -ENOMEM as soon as one allocation fails. This leaves the remaining rxr-rxtpa entries zeroed. bnxtqueuememalloc discards that...