EUVD-2026-93163

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

CVE-2026-98234

The Linux kernel contains a vulnerability in the net/sched subsystem where the hhf_change() function stores the TCA_HHF_HH_FLOWS_LIMIT attribute without an upper bound. An attacker with CAP_NET_ADMIN privileges in a user namespace can set a massive hh_limit value, allowing spoofed traffic to bypa...

CVE-2026-98235

The Linux kernel contains a vulnerability in net/sched: act_api where a batched RTM_DELACTION request can result in a reference leak . The issue occurs because tca_action_gd() calls tcf_action_put_many() to release remaining references upon a deletion failure, but the iterator stops at the first ...

EUVD-2026-93162

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...

CVE-2026-98233

The Linux kernel contains a vulnerability in net/packet where the tpacket_rcv() function fails to release a claimed V1 or V2 ring slot if the virtio-net header conversion fails. This error path leaves the ownership bit set, which can cause an issue where an unsupported UDP GSO packet renders the ...

EUVD-2026-93161

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

EUVD-2026-93160

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-98232

The Linux kernel contains a vulnerability in the scsi core where scsi_cdl_enable() fails to properly validate MODE SENSE length fields. A target can report a total length shorter than its mode header and block descriptors, causing an unsigned subtraction wrap that allows buf_data to point beyond ...

CVE-2026-98231

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem. The issue arises because xfrm_dev_state_flush() drops the xfrm_state_dev_gc_lock before calling xfrm_dev_state_free() to avoid sleeping in driver callbacks. Because the device GC list does not hold an xfrm_state ...

EUVD-2026-93159

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrmdevstateflush finds states under xfrmstatedevgclock, but drops the lock before calling xfrmdevstatefree because the driver callback may sleep. The...

CVE-2026-98230

The Linux kernel contains a vulnerability in the xfrm component related to how state_cache and state_cache_input lists are handled during deletion. The root cause is the use of hlist_del_rcu() instead of hlist_del_init_rcu(). Because hlist_del_rcu() leaves a non-NULL pprev value, a second call to...

EUVD-2026-93158

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlistdelinitrcu for statecache and statecacheinput Commit 14acf9652e56 "xfrm: defensively unhash xfrmstate lists in xfrmstatedelete" converted bydst/bysrc/byseq/byspi from hlistdelrcu to hlistdelinitrcu so that a second...

CVE-2026-98228

The Linux kernel is affected by a memory ordering issue on MIPS I6500 CPU cores . The lld and scd instructions provide no ordering guarantees, which can lead to a failure to respect the assumed full ordering of arch_cmpxchg() . This lack of synchronization can cause system instability, such as ke...

EUVD-2026-93157

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrminput stores the current xfrmstate in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrminput has finished...

EUVD-2026-93156

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

CVE-2026-98229

The Linux kernel contains a vulnerability where xfrm_input() can dereference a freed state. The issue occurs because some input paths, such as VTI and XFRM interfaces , can reset the secpath before xfrm_input() finishes processing. Specifically, if secpath_reset() drops the last state reference w...

CVE-2026-98227

The Linux kernel contains a memory leak vulnerability in the memstick driver. The msb_init_disk() function allocates a per-card ordered workqueue using alloc_ordered_workqueue(), but the workqueue is only destroyed on error paths. Because msb_remove() fails to destroy the workqueue and other clea...

EUVD-2026-93155

In the Linux kernel, the following vulnerability has been resolved: memstick: msblock: destroy ioqueue workqueue on removal msbinitdisk creates the per-card ordered workqueue msb-ioqueue with allocorderedworkqueue. It is torn down with destroyworkqueue only on the init error path; msbremove never...

CVE-2026-98226

The Linux kernel contains a vulnerability where the SWAP_USAGE_OFFLIST_BIT collides with the real usage count because it is defined as bit 30 of an atomic_t type. On systems with 4 KiB pages, this collision occurs once the count reaches 4 TiB . This leads to several issues: /proc/swaps understate...

EUVD-2026-93154

In the Linux kernel, the following vulnerability has been resolved: mm, swap: fix SWAPUSAGEOFFLISTBIT collision with real usage count SWAPUSAGEOFFLISTBIT is embedded in the si-inusepages usage counter, and is meant to sit above any value that counter can reach. However, it is defined from...