CVE-2026-98068 net/rds: don't let rds_conn_shutdown() consume a concurrent drop

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let rdsconnshutdown consume a concurrent drop rdsconnshutdown finishes by moving the path from RDSCONNDISCONNECTING to RDSCONNDOWN, and also accepts RDSCONNERROR as the starting state of that final transition, so...

CVE-2026-98050

The Linux kernel contains a vulnerability in the mlxsw: spectrum_ptp component where mlxsw_sp1_ptp_ht_gc_collect() calls napi_gro_receive() from a PTP garbage-collection workqueue instead of the NAPI poll context. This leads to a race condition because the call mutates the NAPI instance's GRO lis...

EUVD-2026-86703

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

CVE-2026-98050 mlxsw: spectrum_ptp: Fix napi_gro_receive() call from GC workqueue context

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumptp: Fix napigroreceive call from GC workqueue context Currently mlxswsp1ptphtgccollect is run from the PTP garbage-collection workqueue, rather than the NAPI poll context. For any unmatched PTP entries carrying an...

EUVD-2026-86685

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage to handle t...

CVE-2026-98032

The Linux kernel contains a vulnerability where concurrent subbuffer resizes can cause trace_pipe_raw readers to crash or result in uninitialized memory leaks to userspace due to the use of stale size values. The issue is addressed by modifying ring_buffer_alloc_read_page() to handle existing buf...

CVE-2026-98032 tracing: Fix subbuf resize races with trace_pipe_raw readers

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage to handle t...

CVE-2026-98032

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix subbuf resize races with tracepiperaw readers Concurrent subbuffer resizes may crash tracepiperaw readers or leak uninitialized memory to userspace due to stale size values. Modify ringbufferallocreadpage to handle t...

CVE-2026-98020

In the Linux kernel, the following vulnerability has been resolved: pdscore: fix cmdregs access racing BAR unmap on reset pdscresetprepare and pdscresetdone's pdscmapbars error path clear/iounmap cmdregs without devcmdlock, and pdsclegacyfirmwareupdate's download loop derefs cmdregs after droppin...

EUVD-2026-86671

In the Linux kernel, the following vulnerability has been resolved: net: mctp: i3c: serialize probe with bus removal mctpi3cprobe drops busdevslock after finding the matching bus. A concurrent I3CNOTIFYBUSREMOVE can then unregister and free the bus netdev before probe passes its private data to...

CVE-2026-98016 net/mlx5e: Fix use-after-free race in sample_restore_put()

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

EUVD-2026-86669

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

CVE-2026-98016

The Linux kernel contains a use-after-free race condition within the net/mlx5e component, specifically in the sample_restore_put() function. The vulnerability occurs during the concurrent teardown of TC sample rules sharing the same restore context; a thread may re-read restore->count after dr...

CVE-2026-98016 net/mlx5e: Fix use-after-free race in sample_restore_put()

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

CVE-2026-98016

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free race in samplerestoreput Concurrent teardown of TC sample rules sharing the same restore context may re-read restore-count after dropping restorelock. At that point another thread may already have...

CVE-2026-98015 net/mlx5: E-Switch: fix use-after-free in mlx5_eswitch_termtbl_put

In the Linux kernel, the following vulnerability has been resolved: net/mlx5: E-Switch: fix use-after-free in mlx5eswitchtermtblput In mlx5eswitchtermtblput, the zero-ref cleanup check reads tt-refcount after termtblmutex has been released. Two concurrent callers on the same mlx5termtblhandle rac...

CVE-2026-98015

The Linux kernel contains a use-after-free vulnerability in the net/mlx5: E-Switch component within the mlx5_eswitch_termtbl_put() function. The issue arises because the tt->ref_count cleanup check occurs after the termtbl_mutex has been released, allowing a race condition where one caller fre...

CVE-2026-98004 iommu/riscv: Serialize command queue publishing

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

CVE-2026-98004 iommu/riscv: Serialize command queue publishing

In the Linux kernel, the following vulnerability has been resolved: iommu/riscv: Serialize command queue publishing Serialize command queue publishing so software producer state advances only after a command is written and the hardware tail is updated. Wait for hardware consumption outside the...

CVE-2026-97998

A vulnerability exists in the Linux kernel 's netfilter: nfnetlink_log component where instances are refcounted, but memory release only occurs during a 1 -> 0 transition , while unlinking from hashes can happen at any refcount. Uncooperative userspace can trigger a race condition by forcing a...