EUVD-2026-93163

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...

CVE-2026-98235

The Linux kernel contains a vulnerability in net/sched: act_api where a batched RTM_DELACTION request can result in a reference leak . The issue occurs because tca_action_gd() calls tcf_action_put_many() to release remaining references upon a deletion failure, but the iterator stops at the first ...

CVE-2026-98234

The Linux kernel contains a vulnerability in the net/sched subsystem where the hhf_change() function stores the TCA_HHF_HH_FLOWS_LIMIT attribute without an upper bound. An attacker with CAP_NET_ADMIN privileges in a user namespace can set a massive hh_limit value, allowing spoofed traffic to bypa...

EUVD-2026-93162

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: cap hhflowslimit at change time hhfchange stores TCAHHFHHFLOWSLIMIT with no upper bound. A huge hhflowslimit lets each new heavy-hitter flow pass the hhflowscurrentcnt check in allocnewhh and forces a fixed-size...

CVE-2026-98233

The Linux kernel contains a vulnerability in net/packet where the tpacket_rcv() function fails to release a claimed V1 or V2 ring slot if the virtio-net header conversion fails. This error path leaves the ownership bit set, which can cause an issue where an unsupported UDP GSO packet renders the ...

EUVD-2026-93161

In the Linux kernel, the following vulnerability has been resolved: net/packet: clear RX owner on VNET header error Commit 61fad6816fc1 "net/packet: tpacketrcv: avoid a producer race condition" added rxownermap and made tpacketrcv claim a V1 or V2 ring slot before converting the virtio-net header...

EUVD-2026-93160

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Validate MODE SENSE lengths in scsicdlenable scsicdlenable uses length fields returned by MODE SENSE to locate the ATA feature mode page in a 64-byte stack buffer. A target can report a total length shorter than its...

CVE-2026-98232

The Linux kernel contains a vulnerability in the scsi core where scsi_cdl_enable() fails to properly validate MODE SENSE length fields. A target can report a total length shorter than its mode header and block descriptors, causing an unsigned subtraction wrap that allows buf_data to point beyond ...

EUVD-2026-93159

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrmdevstateflush finds states under xfrmstatedevgclock, but drops the lock before calling xfrmdevstatefree because the driver callback may sleep. The...

CVE-2026-98231

A use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem. The issue arises because xfrm_dev_state_flush() drops the xfrm_state_dev_gc_lock before calling xfrm_dev_state_free() to avoid sleeping in driver callbacks. Because the device GC list does not hold an xfrm_state ...

CVE-2026-98230

A write use-after-free vulnerability exists in the Linux kernel within the xfrm subsystem. The issue occurs because state_cache and state_cache_input incorrectly used hlist_del_rcu(), which leaves a non-NULL pprev pointer during deletion. This allows a second __xfrm_state_delete() call on the sam...

EUVD-2026-93158

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlistdelinitrcu for statecache and statecacheinput Commit 14acf9652e56 "xfrm: defensively unhash xfrmstate lists in xfrmstatedelete" converted bydst/bysrc/byseq/byspi from hlistdelrcu to hlistdelinitrcu so that a second...

CVE-2026-98230 xfrm: use hlist_del_init_rcu for state_cache and state_cache_input

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlistdelinitrcu for statecache and statecacheinput Commit 14acf9652e56 "xfrm: defensively unhash xfrmstate lists in xfrmstatedelete" converted bydst/bysrc/byseq/byspi from hlistdelrcu to hlistdelinitrcu so that a second...

CVE-2026-98228

The Linux kernel contains a vulnerability on MIPS I6500 CPU cores due to a lack of ordering guarantees for lld and scd instructions. This issue requires the injection of sync instructions above and below lld/scd loops using the WEAK_REORDERING_BEYOND_LLSC infrastructure to ensure arch_cmpxchg() r...

CVE-2026-98229 xfrm: save input state data before secpath resets

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrminput stores the current xfrmstate in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrminput has finished...

EUVD-2026-93156

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...

EUVD-2026-93157

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrminput stores the current xfrmstate in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrminput has finished...

CVE-2026-98229 xfrm: save input state data before secpath resets

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrminput stores the current xfrmstate in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrminput has finished...

CVE-2026-98229

The Linux kernel contains a vulnerability where xfrm_input() can dereference a freed state because some input paths, such as VTI and XFRM interfaces, can reset the secpath before processing is complete. Specifically, if secpath_reset() drops the last state reference while the state is concurrentl...

CVE-2026-98228 mips: select CONFIG_WEAK_REORDERING_BEYOND_LLSC from CONFIG_EYEQ

In the Linux kernel, the following vulnerability has been resolved: mips: select CONFIGWEAKREORDERINGBEYONDLLSC from CONFIGEYEQ On I6500 CPU cores, lld and scd give no ordering guarantees same as all other instructions. To respect the assumption that archcmpxchg is fully ordered, we must inject...