CVE-2026-99213

A flaw exists in the Linux kernel vsock subsystem where a race condition occurs during the TCP_ESTABLISHED to TCP_CLOSING transition on OP_RST . This race with the connect loop can cause a socket to be improperly handled while still present in the connected_table . Exploitation of this flaw can l...

CVE-2026-99212

A flaw exists in the Linux kernel 's Reliable Datagram Sockets (RDS ) subsystem involving how it handles RDMA connection identifiers. When route resolution fails synchronously during a connection establishment (e.g., due to -ENOMEM , an unsettable SA query, or an unusable RoCE route), the rds_rdm...

CVE-2026-99212 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

CVE-2026-99212 net/rds: don't let the rdma_cm destroy an id RDS still owns on route failure

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

EUVD-2026-111964

In the Linux kernel, the following vulnerability has been resolved: net/rds: don't let the rdmacm destroy an id RDS still owns on route failure rdsrdmacmeventhandlercmn hands the return value of rdmaresolveroute straight back to the rdmacm on RDMACMEVENTADDRRESOLVED. A synchronous failure there -...

CVE-2026-99210

The Linux kernel contains a vulnerability in the accel/rocket driver where rocket_probe() fails to properly clear the rdev pointer upon a rocket_device_init() failure. Because the pointer is left as an ERR_PTR instead of being cleared, subsequent core probes may incorrectly assume the device is i...

CVE-2026-99211 netlink: reset skb headers before unicast and multicast filtering

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99211 netlink: reset skb headers before unicast and multicast filtering

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99211

The Linux kernel is affected by a vulnerability in netlink where producers may reserve skb headroom without resetting the network and MAC headers. This allows a receiving socket's filter to use SKF_NET_OFF and SKF_LL_OFF to read data before the initialized message. Specifically, an unprivileged N...

CVE-2026-99210 accel/rocket: clear rdev on device init failure

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

CVE-2026-99210 accel/rocket: clear rdev on device init failure

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

EUVD-2026-111962

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: clear rdev on device init failure rocketprobe stores the return value from rocketdeviceinit in the file-scoped rdev pointer before checking whether it is an error pointer. If rocketdeviceinit fails, rdev is left as ...

EUVD-2026-111963

In the Linux kernel, the following vulnerability has been resolved: netlink: reset skb headers before unicast and multicast filtering Socket filters can use SKFNETOFF and SKFLLOFF to read relative to an skb's network and MAC headers. Netlink producers may reserve headroom without resetting those...

CVE-2026-99209

The Linux kernel contains a vulnerability in the drm/xe driver where the xe_evict_flags() function incorrectly dereferences a NULL resource when processing a Buffer Object (BO) that has no associated ttm.resource. This typically occurs with imported dma-buf BOs whose resources are freed during te...

CVE-2026-99209 drm/xe: skip eviction of a BO with no resource

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

EUVD-2026-111961

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

CVE-2026-99209 drm/xe: skip eviction of a BO with no resource

In the Linux kernel, the following vulnerability has been resolved: drm/xe: skip eviction of a BO with no resource xeevictflags switches on tbo-resource-memtype to choose an eviction placement. An xe BO can reach eviction with no ttm.resource, e.g. an imported dma-buf BO whose resource was freed...

EUVD-2026-111960

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...

CVE-2026-99208

The Linux kernel contains a vulnerability in the drm/xe/oa component where ttm_bo_type_kernel BOs are not guaranteed to be zeroed upon allocation. This allows the OA buffer to potentially contain stale kernel memory contents from previously freed pages. Because the OA buffer is mmap'able by users...

CVE-2026-99208 drm/xe/oa: Zero OA buffer at allocation

In the Linux kernel, the following vulnerability has been resolved: drm/xe/oa: Zero OA buffer at allocation ttmbotypekernel BOs are not guaranteed to be zeroed on allocation and may contain data from previously freed pages. Since the OA buffer is mmap'able by userspace, this can expose stale kern...