EUVD-2026-93355

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrmstatenetlink builds the ALLOCSPI response with dumponestate, which already calls alloccompat with the response skb and header. xfrmallocuserspi then calls alloccompat again, bu...

CVE-2026-98368

The Linux kernel contains a vulnerability in the ESP (Encapsulating Security Payload) protocol when handling the out-of-place output path (esp->inplace == false ). The issue arises because ESP mutates the skb frag array without properly downgrading zerocopy managed frags (SKBFL_MANAGED_FRAG_RE...

EUVD-2026-93353

In the Linux kernel, the following vulnerability has been resolved: esp: downgrade zerocopy managed frags before mutating skb frags On the out-of-place output path esp-inplace == false ESP rewrites the skb frag array: espoutputhead appends a trailer frag and espoutputtail replaces the frags with ...

CVE-2026-98367

A vulnerability exists in the Linux kernel RDMA/siw component where a Use-After-Free (UAF) condition can occur. If siw_qp_modify() fails within siw_accept(), the state_lock is released before error path cleanup. This creates a race window where a concurrent ibv_modify_qp() call can transition the...

EUVD-2026-93352

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

EUVD-2026-93351

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr reassigns mr-ibmr.pd first and only then validates the IBMRREREGACCESS argument: if flags & IBMRREREGPD rxeputoldpd; rxegetpd; mr-ibmr.pd = ibpd; if flags...

CVE-2026-98366

The Linux kernel RDMA/rxe driver contains a slab-use-after-free vulnerability in the rxe_rereg_user_mr() function. The root cause is that the driver reassigns the memory region's protection domain (mr->ibmr.pd ) before validating the IB_MR_REREG_ACCESS argument. If validation fails, the reassi...

CVE-2026-98364

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem during bundle creation. The functions xfrm_bundle_create() and xfrm_create_dummy_bundle() improperly read dst->dev into a local pointer without acquiring a device reference before passing it to xfrm_fill_dst()....

EUVD-2026-93349

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold netdevice reference under RCU in bundle creation xfrmbundlecreate and xfrmcreatedummybundle read dst-dev into a local pointer without taking a device reference, then pass it to xfrmfilldst. A concurrent RTMDELLINK...

CVE-2026-98365

A vulnerability exists in the Linux kernel RDMA/rxe driver where integer overflow in the mr_check_range() function allows for out-of-bounds (OOB) access . Because the function uses wraparound-prone arithmetic to validate the range of registered Memory Regions (MR), a remote peer can craft an RDMA...

EUVD-2026-93350

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix integer overflow in mrcheckrange leading to OOB access mrcheckrange validates that iova, iova+length falls within the registered MR range using wraparound-prone arithmetic: if iova ibmr.iova || iova + length...

CVE-2026-98363

The Linux kernel contains a vulnerability in the arm_scpi firmware component. The function scpi_dvfs_get_info() failed to validate upper bounds on the opp_count received from the SCP firmware, only rejecting zero counts. Because the shared-memory reply only holds MAX_DVFS_OPPS entries in buf.opps...

EUVD-2026-93348

In the Linux kernel, the following vulnerability has been resolved: firmware: armscpi: reject DVFS OPP count above MAXDVFSOPPS scpidvfsgetinfo already rejected a zero oppcount, but still trusted any larger value from the SCP firmware. The shared-memory reply only holds MAXDVFSOPPS entries in...

CVE-2026-98362

The Linux kernel contains a vulnerability in the SCPI clock driver where dvfs_get_idx() fails to perform an upper bound check on the DVFS index. If the SCP firmware is buggy or provides stale values, it can return a large index that exceeds the info->opps range. This results in a KASAN Out-of-...

EUVD-2026-93347

In the Linux kernel, the following vulnerability has been resolved: clk: scpi: bound-check DVFS index in scpidvfsrecalcrate dvfsgetidx may return an out-of-range index if the SCP firmware is buggy or returns a stale value. Only negative indexes were rejected, so a large index walked past info-opp...

EUVD-2026-93346

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Restore HMMPFNWRITE check in ODP write paths Commit 0b261d7c1cd3 "RDMA/rxe: Break endless pagefault loop for RO pages" dropped the access permission test from rxecheckpagefault and left only HMMPFNVALID. A page faulted ...

CVE-2026-98361

The Linux kernel contains a vulnerability in the RDMA/rxe driver where the rxe_check_pagefault() function failed to perform access permission tests, retaining only the HMM_PFN_VALID check. This allowed ODP write operations, such as RDMA WRITE and SEND payloads, to modify read-only pages (e.g., pa...

CVE-2026-98360

The Linux kernel contains a vulnerability in the RDMA/rxe driver where a newly allocated multicast group (mcg) is published to the mcg_tree before the backing Ethernet multicast address is successfully programmed via rxe_mcast_add(). If rxe_mcast_add() fails (e.g., due to -ENODEV), the system fre...

EUVD-2026-93345

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: insert mcg into mcgtree only after rxemcastadd succeeds rxegetmcg publishes a newly allocated multicast group in rxe-mcgtree before programming the backing Ethernet multicast address with rxemcastadd, which runs outside...

CVE-2026-98358

The Linux kernel contains a vulnerability in the IB/iser stack where the system fails to properly reject remote invalidations of unregistered directions. Specifically, iser_reg_mem_fastreg() leaves rdma_reg[ISER_DIR_OUT].desc as NULL for write commands with immediate data, while iser_dma_map_task...