CVE-2026-98307

The Linux kernel contains a memory leak vulnerability within the ath11k driver. When the firmware crashes, the driver calls ieee80211_restart_hw(), which expects all driver-related resources to be cleaned up. However, ath11k_mac_peer_cleanup_all() fails to free arsta->rx_stats and tx_stats res...

CVE-2026-98307 wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

EUVD-2026-93292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

CVE-2026-98307 wifi: ath11k: cleanup arsta in ath11k_mac_peer_cleanup_all()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath11k: cleanup arsta in ath11kmacpeercleanupall When mac80211 removes a sta, it calls .stastate which in turn calls ath11kmacstationremove. In that function we clean up both peers & arsta related resources. But when the...

CVE-2026-98306

The Linux kernel contains a vulnerability where the IPSKB_L3SLAVE flag is not set during IPIP decapsulation , despite being set for IPv6. Specifically, while vrf_ip6_rcv() sets IP6SKB_L3SLAVE in the IPv6 control block, decap_and_validate() fails to set IPSKB_L3SLAVE in the IPv4 control block. Thi...

CVE-2026-98306 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

EUVD-2026-93291

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98306 seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation

In the Linux kernel, the following vulnerability has been resolved: seg6: set IPSKBL3SLAVE from IP6SKBL3SLAVE on IPIP decapsulation When an SRv6 packet arrives on an interface enslaved to a VRF, vrfip6rcv sets IP6SKBL3SLAVE in IP6CB, but decapandvalidate has never set IPSKBL3SLAVE in IPCB. The bi...

CVE-2026-98305

The Linux kernel contains a vulnerability in the net: dsa: mxl862xx driver where the stats poll is not correctly disabled during teardown. The mxl862xx_setup() function arms the poll before mxl862xx_setup_mdio() , but if dsa_register_switch() returns an error, the dsa_port list is freed while the...

CVE-2026-98305 net: dsa: mxl862xx: disable the stats poll on teardown

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

EUVD-2026-93290

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98305 net: dsa: mxl862xx: disable the stats poll on teardown

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mxl862xx: disable the stats poll on teardown mxl862xxsetup arms the stats poll before mxl862xxsetupmdio, and nothing stops it until dsaregisterswitch has returned an error to mxl862xxprobe. DSA frees the dsaport list...

CVE-2026-98304

The Linux kernel contains a vulnerability in the bcmgenet driver where user-configured hardware filters are silently lost during an interface ifup operation. The root cause is that the bcmgenet_hfb_init() function calls INIT_LIST_HEAD() on the priv->rxnfc_list every time bcmgenet_open() is exe...

CVE-2026-98304 net: bcmgenet: restore the hardware filters on open

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...

EUVD-2026-93289

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...

CVE-2026-98304 net: bcmgenet: restore the hardware filters on open

In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: restore the hardware filters on open bcmgenethfbinit runs INITLISTHEAD on priv-rxnfclist, which drops every rule off the list, and bcmgenetopen calls it on each ifup. Every rule the user configured is silently lost...

CVE-2026-98303 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98303

The Linux kernel is affected by a vulnerability in icmp_route_lookup() where RTN_UNREACHABLE input routes are not properly rejected. When a forward output route is unusable, the kernel performs a reverse path lookup via ip_route_input(). If the source address is unreachable, ip_route_input() succ...

EUVD-2026-93288

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98303 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...