CVE-2026-98301

The Linux kernel contains a vulnerability in the net: bridge: mst component where the br_mst_set_state() function calls switchdev_port_attr_set() while holding an rcu_read_lock() . This is problematic because the switchdev notifier chain can invoke blocking calls and sleep. The issue is triggered...

EUVD-2026-93285

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98300

The Linux kernel contains a vulnerability in the tcp_v6_do_rcv() function where a race condition exists between tcp_v6_rcv() and tcp_v6_do_rcv() . A concurrent close() operation can change the state from TCP_LISTEN to TCP_CLOSE , causing skb_clone_and_charge_r() to be called locklessly. This resu...

EUVD-2026-93282

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcicore: Fix queuing txwork after workqueue is drained hcisendacl, hcisendsco and hcisendiso queue hdev-txwork unconditionally. They can run from the L2CAP/SCO/ISO socket send path while hcidevclosesync is draining...

CVE-2026-98297

A vulnerability exists in the Linux kernel Bluetooth hci_core component where functions hci_send_acl(), hci_send_sco(), and hci_send_iso() unconditionally queue hdev->tx_work. This creates a race condition during hci_dev_close_sync() while draining the hdev->workqueue (triggered by HCIDEVDO...

CVE-2026-98276 net: lock the socket in sock_gettstamp()

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98276

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

EUVD-2026-93204

In the Linux kernel, the following vulnerability has been resolved: net: lock the socket in sockgettstamp sk-skflags must only be changed while holding the socket lock, because socksetflag and sockresetflag use non atomic operations setbit and clearbit. sockgettstamp is one of the last places whe...

CVE-2026-98276

The Linux kernel is vulnerable to a UDP socket use-after-free due to a race condition in sock_gettstamp(). The sk->sk_flags field is modified using non-atomic operations without holding the socket lock, specifically when sock_enable_timestamp() sets the SOCK_TIMESTAMP bit. This allows a SIOCGS...

CVE-2026-98258

A race condition exists in the Linux kernel within the posix-cpu-timers component. The issue stems from a previous commit that converted cpu_timer::firing from a tristate value to a boolean, causing a loss of distinction between timers not owned by the firing list and those where delivery was can...

EUVD-2026-93186

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

CVE-2026-98258 posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list

In the Linux kernel, the following vulnerability has been resolved: posix-cpu-timers: Prevent freeing a timer which is queued on the expiry list Kijo analyzed another race in the POSIX CPU timer code: Commit bf635681c906 converted cputimer::firing from a tristate value to a boolean. This lost the...

EUVD-2026-93184

In the Linux kernel, the following vulnerability has been resolved: signal: Prevent exec race Hyunwoo debugged the following KASAN UAF splat: BUG: KASAN: slab-use-after-free in sendsignallocked+0xb27/0xba0 Write of size 8 at addr ffff888007ed80c8 by task poc/79 ... Call Trace:...

CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98251 openvswitch: avoid reallocating confirmed conntrack labels

In the Linux kernel, the following vulnerability has been resolved: openvswitch: avoid reallocating confirmed conntrack labels ovsctgetconnlabels adds the labels extension when a conntrack entry does not have one. Confirmed conntracks can be read locklessly, so adding an extension may reallocate...

CVE-2026-98234

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...

CVE-2026-98233

The Linux kernel contains a vulnerability in net/packet where the tpacket_rcv() function fails to release a claimed V1 or V2 ring slot if the virtio-net header conversion fails. This error path leaves the ownership bit set, which can cause an issue where an unsupported UDP GSO packet renders the ...

EUVD-2026-93161

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

CVE-2026-98231

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem. The issue arises because xfrm_dev_state_flush() drops the xfrm_state_dev_gc_lock before calling xfrm_dev_state_free() to avoid sleeping in driver callbacks. Because the device GC list does not hold an xfrm_state ...

EUVD-2026-93159

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrmdevstateflush finds states under xfrmstatedevgclock, but drops the lock before calling xfrmdevstatefree because the driver callback may sleep. The...