EUVD-2026-108763

In the Linux kernel, the following vulnerability has been resolved: net/sched: emtext: reject unterminated algo before autoload This is a follow-up to commit 9c572a83037a "net/sched: fix potential stack infoleak in emtextdump", which zero-initialised the dump-side struct. Sashiko pointed at a...

CVE-2026-98968

A use-after-free vulnerability exists in the Linux kernel within the AMT (AMT Device) driver. The issue occurs because an skb queued in a qdisc can outlive the tunnel it references via a raw pointer in skb->cb . Specifically, if a tunnel expires and is freed while a netem delay is still active...

EUVD-2026-108762

In the Linux kernel, the following vulnerability has been resolved: amt: send the relay's General Query directly from the receive path An skb queued in a qdisc can outlive the tunnel it references through a raw pointer in skb-cb. For example, with igmpqrv set to 1 on the relay a tunnel lives for...

CVE-2026-98967

The Linux kernel contains a vulnerability in the cxgb4/ch_ktls component where the tid_list array is handled inconsistently. Specifically, while the receive path correctly uses xa_insert_bh(), the chcr_ktls_dev_del() and chcr_ktls_dev_add() error paths incorrectly use xa_erase(). Because xa_erase...

EUVD-2026-108761

In the Linux kernel, the following vulnerability has been resolved: cxgb4/chktls: disable softirqs around tidlist erases chcrktlscplactopenrpl inserts into tidlist from the receive path using xainsertbh. The array is shared by the adapter's connections and initialized with XAFLAGSLOCKBH. However,...

CVE-2026-98966

The Linux kernel contained a vulnerability within the bonding module where BPF programs were leaked when XDP was replaced. The issue caused leaked programs to accumulate during propagation series tests. This vulnerability has been resolved by ensuring the kernel releases the reference on the old ...

EUVD-2026-108760

In the Linux kernel, the following vulnerability has been resolved: bonding: fix the program leak when XDP is replaced We need to release the reference on the old BPF prog, whether we are going to no-prog, or replacing the prog with another. Spotted by AI while running tests for the propagation...

CVE-2026-98965

The Linux kernel ICE driver contains a concurrency issue affecting arm64 architectures. The driver incorrectly uses writel_relaxed() to update hardware doorbells, which fails to provide necessary ordering guarantees between normal memory and MMIO registers. This allows a race condition where the ...

EUVD-2026-108759

In the Linux kernel, the following vulnerability has been resolved: ice: Restore Ordered MMIO Writes for Tx Doorbells The DQL accounting state which tracks the number of bytes queued for the NIC to transmit, namely dql-numqueued, is updated by the ICE driver when it invokes netdevtxsentqueue...

CVE-2026-98964

The Linux kernel contains a vulnerability in the nvmet component related to metadata allocation. In the function nvmet_req_alloc_p2pmem_sgls(), the req->p2p_dev is only assigned after both data and metadata SGL allocations succeed. However, if data allocation succeeds but metadata allocation f...

EUVD-2026-108758

In the Linux kernel, the following vulnerability has been resolved: nvmet: use the local P2P device on metadata allocation failure nvmetreqallocp2pmemsgls assigns req-p2pdev only after the data and metadata SGL allocations succeed. If the data allocation succeeds but the metadata allocation fails...

CVE-2026-98963

The Linux kernel contains a vulnerability in the btrfs filesystem. Specifically, if all bios finish before btrfs_encoded_read_regular_fill_pages() returns, the call to btrfs_uring_read_extent_endio() could result in a negative errno . This caused a double free and unlock issue because both btrfs_...

EUVD-2026-108757

In the Linux kernel, the following vulnerability has been resolved: btrfs: always return -EIOCBQUEUED after btrfsuringreadextentendio If all bios finish before btrfsencodedreadregularfillpages returns, it calls btrfsuringreadextentendio and previously returned the I/O status. A negative errno the...

CVE-2026-98962

The Linux kernel contains a vulnerability within the btrfs file system. Specifically, after the btrfs_uring_read_extent() function is called, the code incorrectly jumped to out_acct, causing it to skip the kfree(data->iov) operation. This memory deallocation is only appropriate for the -EIOCBQ...

EUVD-2026-108756

In the Linux kernel, the following vulnerability has been resolved: btrfs: free iov when btrfsuringreadextent fails After btrfsuringreadextent, the caller always jumped to outacct. That skips kfreedata-iov, which is only correct for -EIOCBQUEUED where the deferred path owns the iov. On failure,...

CVE-2026-98961

The Linux kernel contains a vulnerability in the btrfs filesystem related to how locks are handled during io_uring operations. Specifically, in the btrfs_uring_read_extent() function, the system takes an inode shared lock and an extent lock . Previously, a pages-array allocation failure would ret...

EUVD-2026-108755

In the Linux kernel, the following vulnerability has been resolved: btrfs: unlock inode and extent in caller when iouring read extent fails btrfsuringreadextent runs only after btrfsencodedread has taken the inode shared lock and the extent lock. On failure it used to unlock in outfail, and a...

CVE-2026-98960

The Linux kernel 's btrfs filesystem contains a vulnerability where btrfs_uring_encoded_data is leaked if the request is cancelled or the ring exits before reissue. This occurs because the kernel returns -EAGAIN while leaving the encoded data in the command PDU, and io_uring does not free driver ...

EUVD-2026-108754

In the Linux kernel, the following vulnerability has been resolved: btrfs: don't stash iouring encoded data across -EAGAIN Returning -EAGAIN while leaving btrfsuringencodeddata in the cmd PDU leaks if the request is cancelled or the ring exits before reissue. iouring does not free driver PDU...

CVE-2026-98959

The Linux kernel contains a vulnerability in the btrfs filesystem where replacing an extended attribute (xattr) value using the setxattr(2) family of syscalls can lead to file system corruption . The issue occurs when multiple xattrs are packed into the same btrfs_dir_item (due to identical crc32...