CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98626

The Linux kernel contains a vulnerability in its CO-RE (Compile Once - Run Everywhere) mechanism. The bpf_core_patch_insn() function incorrectly poisons relocation targets before verifying if they are valid. This allows malformed metadata to replace critical instructions such as jumps, calls, exi...

CVE-2026-98626 bpf: Restrict CO-RE poisoning to relocatable instructions

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

EUVD-2026-103540

In the Linux kernel, the following vulnerability has been resolved: bpf: Restrict CO-RE poisoning to relocatable instructions CO-RE relocation records can name any instruction offset. When a relocation cannot be resolved, bpfcorepatchinsn currently poisons its target before checking whether that...

CVE-2026-98625 netfilter: flowtable: publish HW_DEAD after worker is done

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

EUVD-2026-103539

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

CVE-2026-98625

The Linux kernel contains a use-after-free vulnerability within the netfilter flowtable component. The issue resides in flow_offload_work_del(), which incorrectly sets the NF_FLOW_HW_DEAD bit before clearing the NF_FLOW_HW_PENDING bit. Because the offload worker lacks an RCU read lock or a flow r...

CVE-2026-98625 netfilter: flowtable: publish HW_DEAD after worker is done

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HWDEAD after worker is done flowoffloadworkdel sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remov...

CVE-2026-98624 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close which can call the release function while unrelated socket...

EUVD-2026-103538

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close which can call the release function while unrelated socket...

CVE-2026-98624

A vulnerability exists in the Linux kernel 's netfilter: nfnetlink_queue component where a concurrent thread issuing a close() call can trigger the release function while unrelated socket processes request an UNBIND for the same portid. This race condition leads to a general protection fault (Oop...

CVE-2026-98624 netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinkqueue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close which can call the release function while unrelated socket...

CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

EUVD-2026-103668

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

CVE-2026-98623

The Linux kernel contains a vulnerability in the drm/nouveau/clk component within the nvkm_clk_ustate_update function. The root cause is a use-after-loop error where the code fails to validate if a pointer is valid after a list_for_each_entry() loop completes without hitting a break. This allows ...

CVE-2026-98623 drm/nouveau/clk: fix list cursor use after loop in nvkm_clk_ustate_update

In the Linux kernel, the following vulnerability has been resolved: drm/nouveau/clk: fix list cursor use after loop in nvkmclkustateupdate If listforeachentry exits without hitting a break then "pstate" is not a valid pstate pointer. Introduce a "found" variable instead. The check is reachable fr...

CVE-2026-98622 net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

EUVD-2026-103667

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...

CVE-2026-98622

The Linux kernel contains a flaw in the net/sched: act_ct component where the flow_offload_alloc() function triggers a kernel warning upon failure. These failures occur during benign scenarios, such as when a conntrack entry is dying (e.g., during a raced conntrack flush) or when GFP_ATOMIC alloc...

CVE-2026-98622 net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: don't WARN on benign flowoffloadalloc failure flowoffloadalloc returns NULL when the conntrack entry is dying e.g. raced with a conntrack flush or when the GFPATOMIC allocation fails; both are expected under loa...