CVE-2026-99203 pipe: preserve existing fasync readers on writer setup failure

In the Linux kernel, the following vulnerability has been resolved: pipe: preserve existing fasync readers on writer setup failure FSETFL and FIOASYNC decide whether to invoke -fasync before pipefasync takes pipe-mutex. Two enables of one ORDWR FIFO can therefore both enter the callback...

EUVD-2026-111954

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

CVE-2026-99202 scsi: libsas: Fix SMP IO deadlock during HA resume

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

CVE-2026-99201 netlink: avoid hashing the network namespace pointer

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99201 netlink: avoid hashing the network namespace pointer

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99202

The Linux kernel contains a vulnerability in the scsi: libsas component where a deadlock occurs during HA resume when handling SMP IO . Specifically, the function smp_execute_task_sg() calls pm_runtime_get_sync() on the host before issuing an SMP command; if this command is issued from the HA res...

CVE-2026-99202 scsi: libsas: Fix SMP IO deadlock during HA resume

In the Linux kernel, the following vulnerability has been resolved: scsi: libsas: Fix SMP IO deadlock during HA resume smpexecutetasksg calls pmruntimegetsync on the host before issuing an SMP command. When that command is itself issued from the HA resume path, the getsync deadlocks: it waits for...

CVE-2026-99201

The Linux kernel contains a vulnerability where the netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Because /proc/net/netlink and socket diagnostics expose the table's bucket order, an unprivileged reader can distinguish equal buckets to recover the low bit...

EUVD-2026-111953

In the Linux kernel, the following vulnerability has been resolved: netlink: avoid hashing the network namespace pointer The netlink rhashtable key includes a raw struct net pointer and a user-controlled port ID. Both /proc/net/netlink and socket diagnostics expose the table's bucket order. By...

CVE-2026-99200

The Linux kernel contains a vulnerability in the hisilicon hisi_femac driver. The hisi_femac_drv_probe() function connects the PHY before dev->netdev_ops is assigned. When CONFIG_NET_SHAPER is enabled, phy_link_topo_add_phy() attempts to read dev->netdev_ops via netdev_need_ops_lock() , lea...

CVE-2026-99200 net: hisilicon: hisi_femac: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99200 net: hisilicon: hisi_femac: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

EUVD-2026-111952

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hisifemac: Move setting of netops to fix crash hisifemacdrvprobe connects the PHY before dev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commi...

CVE-2026-99199

The Linux kernel contains a vulnerability in the hisilicon hip04_eth driver where the hip04_mac_probe() function calls of_phy_connect() before ndev->netdev_ops is assigned. This root cause leads to a NULL pointer dereference during probing when CONFIG_NET_SHAPER is enabled, as phy_link_topo_ad...

CVE-2026-99199 net: hisilicon: hip04_eth: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

CVE-2026-99199 net: hisilicon: hip04_eth: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

EUVD-2026-111951

In the Linux kernel, the following vulnerability has been resolved: net: hisilicon: hip04eth: Move setting of netops to fix crash hip04macprobe calls ofphyconnect before ndev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through netdevneedopslock since the commit ...

CVE-2026-99198

The Linux kernel contains a vulnerability where the owl_emac_probe() function calls owl_emac_phy_init() to connect the PHY before netdev->netdev_ops is assigned. This sequence causes phy_attach_direct() to attempt to read dev->netdev_ops via netdev_need_ops_lock(), resulting in a NULL point...

CVE-2026-99198 net: ethernet: actions: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...

CVE-2026-99198 net: ethernet: actions: Move setting of netops to fix crash

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: actions: Move setting of netops to fix crash owlemacprobe calls owlemacphyinit, which connects the PHY, before netdev-netdevops is assigned. phyattachdirect - phylinktopoaddphy reads dev-netdevops through...