EUVD-2026-108827

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smcgetname smcgetname dereferences smc-clcsock without holding clcsockreleaselock. Link-group termination can release the CLC socket through smccloseactiveabort while the SMC socket is still...

CVE-2026-99032

The Linux kernel is vulnerable to a use-after-free or NULL dereference in the smc_getname() function within the net/smc component. The issue occurs because smc_getname() dereferences smc->clcsock without acquiring the clcsock_release_lock. If a link-group termination triggers smc_close_active_...

CVE-2026-99031 net: bridge: avoid recursive multicast port cleanup

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...

CVE-2026-99031

The Linux kernel contains a vulnerability in the net: bridge component where the function br_multicast_sg_del_exclude_ports() performs a recursive call to br_multicast_del_pg(). For S,G entries , this recursion causes each STAR_EXCL port to consume one kernel stack frame. A large number of these ...

CVE-2026-99031 net: bridge: avoid recursive multicast port cleanup

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...

EUVD-2026-108826

In the Linux kernel, the following vulnerability has been resolved: net: bridge: avoid recursive multicast port cleanup brmulticastsgdelexcludeports removes automatically added STAREXCL port groups by calling brmulticastdelpg. For S,G entries, that deletion calls back into...

EUVD-2026-108825

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030 net: skbuff: don't leave stale bytes in skb_copy_and_csum_bits()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't leave stale bytes in skbcopyandcsumbits When skbcopyandcsumbits reaches unreadable frags it returns 0 after copying only the linear part, and the rest of the caller's buffer is left as it was. The callers copy...

CVE-2026-99030

The Linux kernel contains a vulnerability in the skb_copy_and_csum_bits() function where unreadable fragments cause the function to return 0 after only copying the linear part. This leaves stale bytes in the caller's buffer, which is then sent over the wire as part of an ICMP error quote or a dri...

CVE-2026-99029 net: sparx5: free the matchall entry on destroy

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

CVE-2026-99029

The Linux kernel contains a memory leak vulnerability in the sparx5 network driver. Specifically, the function sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for offloaded matchall filters, but sparx5_tc_matchall_destroy() removes these entries from the list without freeing the...

EUVD-2026-108824

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

CVE-2026-99029 net: sparx5: free the matchall entry on destroy

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

CVE-2026-99028 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

EUVD-2026-108823

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

CVE-2026-99028

The Linux kernel contains a vulnerability in the xilinx axienet driver where outstanding DMA buffers are leaked during dmaengine_stop. Specifically, dmaengine_terminate_sync() aborts descriptors without executing completion callbacks, causing the driver to free only the ring shells while leaking ...

CVE-2026-99028 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

CVE-2026-99027 net: team: stop reusing skb after queue override

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

CVE-2026-99027

The Linux kernel contains a slab-use-after-free vulnerability within the net: team component. The issue occurs because a nonzero dev_queue_xmit() result does not return ownership of the skb . Consequently, when an override port's qdisc drops the packet, the queue override helper incorrectly attem...