CVE-2026-99077

The Linux kernel contains a vulnerability where FIB nexthop exceptions (FNHE) are only created if a quoted UDP packet matches an existing socket. This allows off-path attackers to conduct a side-channel attack on the FNHE cache to discover ephemeral ports of connected UDP sockets. Previous mitiga...

EUVD-2026-108743

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99077 ipv4: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv4: udp: Create exceptions before socket matching Currently, when ICMP Fragmentation Needed and Redirect Message packets are locally delivered and quote a UDP packet, a FIB nexthop exception FNHE is only created if the kernel c...

CVE-2026-99076 ipv6: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

EUVD-2026-108742

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

CVE-2026-99076 ipv6: udp: Create exceptions before socket matching

In the Linux kernel, the following vulnerability has been resolved: ipv6: udp: Create exceptions before socket matching Currently, when ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, an exception is only created in the IPv6 exception cache if the...

CVE-2026-99076

The Linux kernel is vulnerable to a side-channel attack in the IPv6 implementation. When ICMPv6 Packet Too Big and Redirect Message packets are locally delivered and quote a UDP packet, the kernel previously only created an exception in the IPv6 exception cache if the UDP packet matched an existi...

CVE-2026-99075

The Linux kernel contains a vulnerability in the rust_binder component regarding a reschedule node refcount update during thread exit. When a thread exits via BINDER_THREAD_EXIT, pending work items are cancelled. If a thread exits while holding a pending node refcount increment as deferred work, ...

CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

EUVD-2026-108741

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

CVE-2026-99075 rust_binder: reschedule node refcount update on thread exit

In the Linux kernel, the following vulnerability has been resolved: rustbinder: reschedule node refcount update on thread exit When a thread exits via BINDERTHREADEXIT, its pending work items are cancelled. If a thread exits while holding a pending node refcount increment e.g. pushed as deferred...

EUVD-2026-108740

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

CVE-2026-99074 ipv4: stop PMTU walk when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

CVE-2026-99074

The Linux kernel contains a vulnerability where a null-pointer dereference can occur during the PMTU (Path MTU) walk process. The root cause is a race condition: while RCU protects the lifetime of nexthop groups, it does not ensure that fib_info_num_path() and fib_info_nhc() observe the same grou...

CVE-2026-99074 ipv4: stop PMTU walk when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop PMTU walk when nexthop group shrinks Commit 7d3f3b4367f3 "net: ipv4: Cache pmtu for all packet paths if multipath enabled" made iprtupdatepmtu update every path. For nexthop objects, fibinfonumpath and fibinfonhc...

CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99073

The Linux kernel contains a vulnerability where an IPv4 Forwarding Information Base (FIB) dump could lead to a null pointer dereference. The issue occurs because fib_dump_info_fnhe() uses a loop bound that may become invalid if an RTM_NEWNEXTHOP operation replaces a nexthop group with fewer paths...

EUVD-2026-108739

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99073 ipv4: stop exception dump when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop exception dump when nexthop group shrinks Commit 4ce5dc9316de "inet: switch inetdumpfib to RCU protection" allowed IPv4 FIB dumps to run concurrently with nexthop replacement. fibdumpinfofnhe uses fibinfonumpath as the...

CVE-2026-99072 ipv4: stop route notification sizing when nexthop group shrinks

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...