CVE-2026-80998

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

CVE-2026-80997

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

CVE-2026-80997

A race condition in the Linux kernel's IP Accelerator (IPA) network driver can cause a permanent transmit (TX) queue stall after a runtime resume. The function ipa_start_xmit() stops the TX queue and relies on a work item (ipa_modem_wake_queue_work()) to restart it, but that work is queued before...

CVE-2026-80998 net: bnxt: ring the doorbell when SW USO exits early

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

CVE-2026-80998

CVE-2026-80998 affects the Linux kernel's bnxt network driver. When the Software UDP Segmentation Offload (SW USO) path (bnxt_sw_udp_gso_xmit) returns early with NETDEV_TX_BUSY while txr->kick_pending is set, the driver writes buffer descriptors but never rings the hardware doorbell , causing ...

CVE-2026-80997 net: ipa: fix stalled modem TX queue after runtime resume

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

EUVD-2026-76321

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

CVE-2026-80998 net: bnxt: ring the doorbell when SW USO exits early

In the Linux kernel, the following vulnerability has been resolved: net: bnxt: ring the doorbell when SW USO exits early When a burst of packets is handed down to the driver, the driver defers the doorbell to the end by setting txr-kickpending = 1. The normal TX path handles this, but the SW USO...

EUVD-2026-76320

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

CVE-2026-80997 net: ipa: fix stalled modem TX queue after runtime resume

In the Linux kernel, the following vulnerability has been resolved: net: ipa: fix stalled modem TX queue after runtime resume ipastartxmit unconditionally stops the TX queue before calling pmruntimeget, relying on the wake scheduled by runtime resume ipamodemwakequeuework to restart it once power...

EUVD-2026-76319

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

CVE-2026-80996

CVE-2026-80996 affects the Linux kernel 's L2TP (Layer 2 Tunneling Protocol) subsystem. The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail during message allocation, encoding, or multicasting. Because th...

CVE-2026-80996 net: l2tp: do not propagate multicast notification errors

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

CVE-2026-80996 net: l2tp: do not propagate multicast notification errors

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

CVE-2026-80996

In the Linux kernel, the following vulnerability has been resolved: net: l2tp: do not propagate multicast notification errors The tunnel create, tunnel modify, session create, and session modify netlink handlers send multicast notifications through helpers that can fail while allocating or encodi...

EUVD-2026-76318

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

EUVD-2026-76317

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

CVE-2026-80995

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80995 net: mctp: hold a reference to the route device in mctp_route_lookup()

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...

CVE-2026-80995 net: mctp: hold a reference to the route device in mctp_route_lookup()

In the Linux kernel, the following vulnerability has been resolved: net: mctp: hold a reference to the route device in mctproutelookup mctproutelookup uses rt-dev without holding a reference on it. mctproutelookupsingle returns the route under RCU only, so the route's device can be torn down...