CVE-2026-98325 wifi: mac80211: set up the TX info early to fix failure paths

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: set up the TX info early to fix failure paths The previous commit 2c51457d930f "wifi: mac80211: free ack status frame on TX header build failure" cleaned up the leak, but still left the code a bit messy and the...

CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

EUVD-2026-93308

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98324 dmaengine: pxa: fix double counting of the hw descriptors

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98323 RDMA/siw: Bound fragmented header copies by the remaining length

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98324

The Linux kernel contains a vulnerability within the dmaengine: pxa component caused by double counting of hardware descriptors . Specifically, when pxad_alloc_desc() was converted to use kzalloc_flex(), it began setting the sw_desc->nb_desc counter automatically in newer compilers (GCC 15.1+ ...

CVE-2026-98323

The Linux kernel is vulnerable to an out-of-bounds (OOB) write due to how the RDMA/siw component handles fragmented header copies. Specifically, the siw_get_hdr() function can receive an extended DDP/RDMAP header across multiple TCP callbacks. If the first callback receives most of the header, th...

EUVD-2026-93309

In the Linux kernel, the following vulnerability has been resolved: dmaengine: pxa: fix double counting of the hw descriptors pxadallocdesc was converted from kzallocstructsizeswdesc, hwdesc, nbhwdesc, GFPNOWAIT to kzallocflex, which sets the countedby counter swdesc-nbdesc itself - but only wher...

CVE-2026-98322

The Linux kernel contains a vulnerability in netfilter: nft_nat where the nft_nat_setup_netmap() function fails to fully initialize the new_addr variable. Specifically, for IPv4 mapping , only the 4-byte .ip member is written to an on-stack union nf_inet_addr. However, the code subsequently copie...

CVE-2026-98322 netfilter: nft_nat: fully initialise new_addr in netmap setup

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

EUVD-2026-93307

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

CVE-2026-98322 netfilter: nft_nat: fully initialise new_addr in netmap setup

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftnat: fully initialise newaddr in netmap setup nftnatsetupnetmap builds the mapped address in an on-stack union nfinetaddr. For an IPv4 mapping it writes only the 4-byte .ip member and the loop runs a single 32-bit...

CVE-2026-98321 netfilter: nf_nat: unregister and release hooks on error

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: unregister and release hooks on error If nfhookentriesinsertraw fails, the NAT hooks get never released, resulting in a memleak. Postpone setting natprotonet-nathookops when the hooks are registered to simplify...

EUVD-2026-93306

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: unregister and release hooks on error If nfhookentriesinsertraw fails, the NAT hooks get never released, resulting in a memleak. Postpone setting natprotonet-nathookops when the hooks are registered to simplify...

CVE-2026-98321

The Linux kernel contains a vulnerability in the netfilter: nf_nat component where a failure in nf_hook_entries_insert_raw() prevents NAT hooks from being released. This flaw results in a memory leak . The issue is addressed by postponing the setting of nat_proto_net->nat_hook_ops during hook ...

CVE-2026-98321 netfilter: nf_nat: unregister and release hooks on error

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnat: unregister and release hooks on error If nfhookentriesinsertraw fails, the NAT hooks get never released, resulting in a memleak. Postpone setting natprotonet-nathookops when the hooks are registered to simplify...

CVE-2026-98320 netfilter: flowtable: hold reference on ct until flow is released

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

EUVD-2026-93305

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ...

CVE-2026-98320

The Linux kernel is affected by a vulnerability in the netfilter flowtable component. The root cause is that nf_ct_put() releases the ct->ext area immediately, which allows the datapath to potentially refer to the incorrect conntrack due to rcu typesafe semantics. To resolve this, the kernel m...