CVE-2026-99047 gve: fix XSK buffer leak when rings are stopped

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak when rings are stopped GVE does not free XSK buffers when resetting ring state as a part of stopping queues. This causes all XSK buffers which are posted to the NIC to be leaked. Free XSK buffers attached...

CVE-2026-99046

A memory leak exists in the Linux kernel related to the gve component. Specifically, when the error bit is set in the RX completion descriptor , the buf_state and its attached buffer are not properly freed in the case of AF_XDP ZC , leading to an XSK buffer leak . This issue has been resolved in ...

EUVD-2026-108841

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99046 gve: fix XSK buffer leak on error descriptor

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99046 gve: fix XSK buffer leak on error descriptor

In the Linux kernel, the following vulnerability has been resolved: gve: fix XSK buffer leak on error descriptor When the error bit is set in the RX completion descriptor, the bufstate and its attached buffer should be freed. In the case of AFXDP ZC, the XSK buffer was not freed, leading to a lea...

CVE-2026-99045 ibmveth: h_free logical LAN on open-fail after register

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...

CVE-2026-99045

The Linux kernel contains a vulnerability in the ibmveth driver. During the ibmveth_open() process, a failure in allocating RX buffer pools caused the execution to jump to out_free_buffer_pools without calling h_free_logical_lan(). This resulted in the PHYP still owning the buffer-list page even ...

EUVD-2026-108840

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...

CVE-2026-99045 ibmveth: h_free logical LAN on open-fail after register

In the Linux kernel, the following vulnerability has been resolved: ibmveth: hfree logical LAN on open-fail after register ibmvethopen registers the logical LAN, then allocates the RX buffer pools. A pool failure jumps to outfreebufferpools without hfreelogicallan, so PHYP still owns the...

EUVD-2026-108839

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044

A use-after-free vulnerability exists in the Linux kernel 's ice driver during dynamic port cleanup. Specifically, the ice_dealloc_dynamic_port() function attempts to access dyn_port->vsi->idx to erase a dynamic port from pf->dyn_ports, but it incorrectly frees the VSI before reading the...

CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

CVE-2026-99044 ice: fix use-after-free in dynamic port cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix use-after-free in dynamic port cleanup icedeallocdynamicport uses dynport-vsi-idx to erase the dynamic port from pf-dynports. However, it frees the VSI before reading the index for the erase, resulting in a use-after-fre...

EUVD-2026-108838

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99043

The Linux kernel contains a vulnerability in the ice driver where ice_eswitch_release_repr() incorrectly uses metadata_dst_free() to release the representor's metadata_dst. This function frees memory directly without checking the dst_entry refcount. Consequently, if a representor is torn down whi...

CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99043 ice: fix metadata_dst refcount handling on representor teardown

In the Linux kernel, the following vulnerability has been resolved: ice: fix metadatadst refcount handling on representor teardown iceeswitchreleaserepr uses metadatadstfree to release the representor's metadatadst. metadatadstfree directly frees the underlying memory without checking the dstentr...

CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

EUVD-2026-108837

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...

CVE-2026-99042 io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6

In the Linux kernel, the following vulnerability has been resolved: iouring/net: populate CONNECT filter fields for 24-byte sockaddrin6 ioconnectbpfpopulate fills connect.port and connect.v6addr for AFINET6 only when addrlen = sizeofstruct sockaddrin6, i.e. 28 bytes. The IPv6 connect paths accept...