CVE-2026-99056

A race condition exists in the Linux kernel 's strparser component, specifically affecting espintcp . The vulnerability occurs because the system may attempt to tear down the parser while __strp_recv is still executing. This lack of synchronization can lead to a Use-After-Free (UAF) condition. To...

EUVD-2026-108850

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

CVE-2026-99055

The Linux kernel contains a vulnerability where the can_map_frag() function dereferences a null pointer when processing net_iov fragments during zerocopy receive mapping . Specifically, skb_frag_page() returns NULL for a net_iov, but can_map_frag() fails to handle this, leading to a null-ptr-dere...

EUVD-2026-108849

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99054

The Linux kernel contains a vulnerability in the tipc component where tipc_topsrv_stop() closes subscriber connections while the topology server's send and receive workqueues are still running. This race condition allows socket callbacks or subscription events to queue additional work, leading to...

EUVD-2026-108848

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

CVE-2026-99053

The Linux kernel is vulnerable to a slab-use-after-free flaw within the tipc (TIPC) component. The root cause is that tipc_node_find_by_name() returns a node after releasing its RCU read lock without taking a reference. This creates a race condition where tipc_node_timeout() can free the node whi...

EUVD-2026-108847

In the Linux kernel, the following vulnerability has been resolved: selinux: preserve NATIVELABELS on already-initialized sb in setmntopts When an NFSv4 filesystem exported with securitylabel is mounted a second time, sgetfc returns the existing superblock and nfsgetroot calls securitysbsetmntopt...

CVE-2026-99052

The Linux kernel contains a vulnerability where mounting an NFSv4 filesystem exported with security_label a second time can lead to a security regression. When the filesystem is remounted, sget_fc() returns the existing superblock, causing selinux_set_mnt_opts() to take an early exit without sett...

EUVD-2026-108846

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverityinfo fsveritygetinfo calls rhashtablelookupfast, which just uses rcureadlock and doesn't directly synchronize with fsverityremoveinfo. For the same inode this isn't a problem: its...

CVE-2026-99051

The Linux kernel contains a vulnerability in fsverity where the __fsverity_get_info() function calls rhashtable_lookup_fast() without direct synchronization with fsverity_remove_info(). While safe for the same inode, this lack of synchronization can cause a use-after-free condition during concurr...

EUVD-2026-108845

In the Linux kernel, the following vulnerability has been resolved: gpio: mpsse: fix race when arming the IRQ poll worker gpiompsseirqenable arms the poll worker before publishing it: schedulework runs before the worker is added to priv-workers. If gpiompssedisconnect walks the list in that windo...

CVE-2026-99050

A use-after-free vulnerability exists in the Linux kernel within the gpio: mpsse component. The issue is caused by a race condition in gpio_mpsse_irq_enable(), where the poll worker is armed before being published. This allows gpio_mpsse_disconnect() to miss the worker, leading the USB core to fr...

EUVD-2026-108844

In the Linux kernel, the following vulnerability has been resolved: gpio: xilinx: fix runtime PM leak on request error path pmruntimegetsync leaves the usage counter incremented even when it fails, and xgpiorequest returns the error without dropping it. gpiolib does not call -free when -request...

CVE-2026-99049

The Linux kernel contains a runtime PM leak within the xilinx gpio driver. The issue occurs because pm_runtime_get_sync() increments the usage counter even on failure, and xgpio_request() returns errors without releasing the reference. Because gpiolib fails to call ->free() on request errors, ...

EUVD-2026-108843

In the Linux kernel, the following vulnerability has been resolved: gve: fix napidisable deadlock when attempting to disable XSK pools When disabling XSK pools, GVE calls the unlocked versions of napidisable and napienable. However, the netdev lock has already been acquired before ndobpf is calle...

CVE-2026-99048

The Linux kernel contains a deadlock vulnerability within the GVE component when attempting to disable XSK pools . The root cause is that GVE calls the unlocked versions of napi_disable and napi_enable while the netdev lock is already held due to support for queue management operations. This resu...

EUVD-2026-108842

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached...

CVE-2026-99047

The Linux kernel contains a vulnerability in the GVE component where XSK buffers are leaked when resetting ring states during queue stops. The root cause is that GVE fails to free buffers attached to an allocated buf_state when stopping rings, causing all posted buffers to be leaked. This issue w...

EUVD-2026-108841

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...