CVE-2026-98304

The Linux kernel contains a vulnerability in the bcmgenet driver where user-configured hardware filters are silently lost during an interface ifup operation. The root cause is that the bcmgenet_hfb_init() function calls INIT_LIST_HEAD() on the priv->rxnfc_list every time bcmgenet_open() is exe...

CVE-2026-98303 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98303

The Linux kernel is affected by a vulnerability in icmp_route_lookup() where RTN_UNREACHABLE input routes are not properly rejected. When a forward output route is unusable, the kernel performs a reverse path lookup via ip_route_input(). If the source address is unreachable, ip_route_input() succ...

CVE-2026-98303 ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

EUVD-2026-93288

In the Linux kernel, the following vulnerability has been resolved: ipv4: icmp: reject RTNUNREACHABLE input routes in icmproutelookup When the forward output route cannot be used in icmproutelookup, it enters the "reverse path" and calls iprouteinput on fl4dec.daddr, the original packet's source...

CVE-2026-98302 net: fddi: skfp: fix NULL deref when setting the MAC address while down

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

EUVD-2026-93287

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

CVE-2026-98302

The Linux kernel contains a NULL pointer dereference vulnerability in the skfp (FDD-II) driver. The issue occurs because skfp_ctl_set_mac_address() calls ResetAdapter() unconditionally without verifying if the network interface is running via netif_running(). On an interface that has never been i...

CVE-2026-98302 net: fddi: skfp: fix NULL deref when setting the MAC address while down

In the Linux kernel, the following vulnerability has been resolved: net: fddi: skfp: fix NULL deref when setting the MAC address while down skfpctlsetmacaddress calls ResetAdapter unconditionally, without checking netifrunning. ResetAdapter first calls cardstop, which sets smc-hw.hwstate to...

CVE-2026-98300 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98301 net: bridge: mst: move switchdev call outside rcu

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

CVE-2026-98300

The Linux kernel contains a vulnerability in the tcp_v6_do_rcv() function where a race condition exists between tcp_v6_rcv() and tcp_v6_do_rcv() . A concurrent close() operation can change the state from TCP_LISTEN to TCP_CLOSE , causing skb_clone_and_charge_r() to be called locklessly. This resu...

EUVD-2026-93285

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98300 tcp: Don't call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().

In the Linux kernel, the following vulnerability has been resolved: tcp: Don't call skbcloneandcharger for closed listener in tcpv6dorcv. tcpv6dorcv no longer calls skbcloneandcharger for TCPLISTEN since commit 073d89808c06 "net: fix data-races around sk-skforwardalloc". However, there is still a...

CVE-2026-98301 net: bridge: mst: move switchdev call outside rcu

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

EUVD-2026-93286

In the Linux kernel, the following vulnerability has been resolved: net: bridge: mst: move switchdev call outside rcu This is a follow-up of one of sashiko's pre-existing bug reports. brmstsetstate calls switchdevportattrset for nonzero MSTIs while holding rcureadlock which invokes the blocking...

CVE-2026-98301

The Linux kernel contains a vulnerability in the net: bridge: mst component where the br_mst_set_state() function calls switchdev_port_attr_set() while holding an rcu_read_lock() . This is problematic because the switchdev notifier chain can invoke blocking calls and sleep. The issue is triggered...

CVE-2026-98299 tcp: do not let tcp_rmem be set below 4096

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

EUVD-2026-93284

In the Linux kernel, the following vulnerability has been resolved: tcp: do not let tcprmem be set below 4096 We can hit a division by zero crash in tcprcvbufgrow and tcprcvspaceadjust: divide error: 0000 1 PREEMPT SMP RIP: 0010:tcprcvbufgrow+0x187/0x450 net/ipv4/tcpinput.c:939 ... grow =...

CVE-2026-98299

The Linux kernel is vulnerable to a division by zero crash in the tcp_rcvbuf_grow() and tcp_rcv_space_adjust() functions within net/ipv4/tcp_input.c. The root cause is that if net.ipv4.tcp_rmem is configured with arbitrarily small values (e.g., 1), sk->sk_rcvbuf is initialized to 1, causing tp...