EUVD-2026-93216

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmactsoxmit stores the protocol header length returned by stmmactsoheadersize in a u8. stmmactsovalidpacket admits headers up to 1023 bytes, so a header longer than 255 bytes wraps...

CVE-2026-98286

The Linux kernel contains a vulnerability in the drop_monitor component where per-CPU timers are improperly handled during teardown paths, such as net_dm_trace_off_set(). A circular dependency between send_timer and dm_alert_work allows a worker to re-arm a timer via mod_timer following a memory ...

EUVD-2026-93214

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98287

The Linux kernel contains a vulnerability in the pppoatm component where the pppoatm_send() function fails to ensure the skb header is writable when performing LLC encapsulation. While standard packets use skb_cow_head(), packets arriving via PPP channel bridging (PPPIOCBRIDGECHAN) bypass this ch...

EUVD-2026-93215

In the Linux kernel, the following vulnerability has been resolved: pppoatm: ensure a writable skb header and linear data In pppoatmsend, LLC encapsulation checks whether there is sufficient headroom for the 4-byte LLC header, but does not ensure that the skb header is writable. Normal transmit...

CVE-2026-98285

The Linux kernel contains a vulnerability in the net: bridge: vlan component where switchdev could prevent vlan deletion and trigger errors in __vlan_del. This flaw can lead to inconsistent states , memory leaks , and a NULL pointer dereference during bridge flushing. The fix involves logging the...

EUVD-2026-93213

In the Linux kernel, the following vulnerability has been resolved: net: bridge: vlan: fix bugs caused by switchdev deletion errors Allowing switchdev to prevent vlan deletion and error out in vlandel could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL...

EUVD-2026-93212

In the Linux kernel, the following vulnerability has been resolved: netlink: do not free nlk-groups while lockless readers can use it netlinkreallocgroups uses krealloc under netlinktablegrab. Whenever NLGRPSZgroups lands in a different kmalloc bucket, the old bitmap is freed immediately. Two...

CVE-2026-98284

The Linux kernel contains a vulnerability where netlink_realloc_groups() uses krealloc() to reallocate the nlk->groups bitmap. If the new size falls into a different kmalloc bucket , the old bitmap is freed immediately while lockless readers—specifically sk_diag_dump_groups() and netlink_nativ...

CVE-2026-98283

The Linux kernel contains a use-after-free vulnerability in the KVM subsystem specifically affecting PPC Book3S HV . The issue exists in the kvmhv_emulate_tlbie_all_lpid() function, which fails to maintain a reference on the kvm_nested_guest pointer after dropping the mmu_lock. A concurrent vCPU ...

EUVD-2026-93211

In the Linux kernel, the following vulnerability has been resolved: KVM: PPC: Book3S HV: fix use-after-free in kvmhvemulatetlbiealllpid kvmhvemulatetlbiealllpid iterates the nested-guest IDR and drops mmulock before calling kvmhvemulatetlbielpid, but does not hold a reference on the kvmnestedgues...

CVE-2026-98282

The Linux kernel contains a vulnerability in the powerpc/iommu component. The issue stems from the iommu_tce_check_ioba function, where the npages argument was being ignored in favor of a constant value of '1' during the unification of IOBA parameter checking for KVM and VFIO . This oversight all...

EUVD-2026-93210

In the Linux kernel, the following vulnerability has been resolved: powerpc/iommu: Fix the overflow validation in iommutcecheckioba The commit b1af23d836f8 "KVM: PPC: iommu: Unify TCE checking" unified IOBA parameter checking across KVM and VFIO into iommutcecheckioba. While doing so, the passed ...

EUVD-2026-93209

In the Linux kernel, the following vulnerability has been resolved: futex: Also allocate private hash on vfork As Jann demonstrated, it is entirely feasible to access the mm through vfork. Therefore we need to allocate a private hash on vfork as well as any other CLONEVM user. Specifically, it mu...

CVE-2026-98281

The Linux kernel contains a vulnerability where it fails to allocate a private hash on vfork() for CLONE_VM users. Because it is possible to access the mm through vfork() , the kernel must ensure a private hash is allocated to prevent issues with futex waiters. The vulnerability has been resolved...

CVE-2026-98279

The Linux kernel contains a vulnerability in the btrfs filesystem where a lack of space or a qgroup limit during the cleanup of verity items can cause the entire filesystem to be forced into read-only mode. This occurs because rollback_verity() requires its own metadata reservation; if denied, th...

EUVD-2026-93207

In the Linux kernel, the following vulnerability has been resolved: btrfs: handle lack of space when cleaning up verity items When enableverity hits the qgroup limit, rollbackverity needs its own metadata reservation. When the qgroup limit or lack of space refuses the rollback, the whole filesyst...

CVE-2026-98280

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the drm/xe/i2c component. The issue occurs because struct xe_i2c is freed before the SGUnit IRQ is disabled during the unbind path. This creates a small window where the I2C IRQ could be triggered while the structure is already...

EUVD-2026-93208

In the Linux kernel, the following vulnerability has been resolved: drm/xe/i2c: Disable IRQ on unbind Currently, struct xei2c is freed before SGUnit IRQ is disabled in unbind path, leaving a potential UAF in case I2C IRQ is hit during this small window. Explicitly disable I2C IRQ in xei2cremove a...

CVE-2026-98278

The Linux kernel contains a logic issue where dev_fill_forward_path() triggers a WARN_ON_ONCE warning when a flowtable attempts to offload a flow through a tunnel that resolves back to itself. This routing loop can be configured by any user with CAP_NET_ADMIN privileges. Because ip_tunnel_xmit() ...