EUVD-2026-93202

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

CVE-2026-98274

The Linux kernel contains a conflict between PSP and the TLS ULP regarding the usage of skb->decrypted and sk->sk_validate_xmit_skb(). To resolve this, PSP is made mutually exclusive with TLS ULP. The fix involves including all TCP ULPs in the sk_has_decrypt_user() check to close potential ...

CVE-2026-98274 net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

CVE-2026-98274 net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb()

In the Linux kernel, the following vulnerability has been resolved: net: psp: avoid conflicts with skb-decrypted and skvalidatexmitskb PSP conflicts with TLS ULP in its usage of both skb-decrypted and sk-skvalidatexmitskb. Make PSP mutually exclusive with TLS ULP, the only other user of either of...

CVE-2026-98273 x86/kprobes: Fix crash when probing CS CALL instructions

In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the hrtimerrunqueues function: : nopl...

EUVD-2026-93201

In the Linux kernel, the following vulnerability has been resolved: x86/kprobes: Fix crash when probing CS CALL instructions When using eBPF to probe CS CALL instructions within a function, a crash can be triggered. The eBPF tool probes offset 257 of the hrtimerrunqueues function: : nopl...

CVE-2026-98273

The Linux kernel is vulnerable to a crash when using eBPF to probe CS CALL instructions within a function. The root cause is that kprobes (using INT3 as the underlying implementation) incorrectly assumes a CALL instruction is 5 bytes long, while a CS-prefixed CALL occupies 6 bytes. This leads to ...

CVE-2026-98272 net: mvpp2: prevent buffer overflow in page_pool allocation

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98271

A vulnerability in the Linux kernel network stack involves stale header offsets remaining after the pskb_carve() operation. Specifically, the functions pskb_carve_inside_header() and pskb_carve_inside_nonlinear() reallocate skb->head but fail to properly update header offsets, leaving skb->...

EUVD-2026-93199

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskbcarve pskbcarveinsideheader and pskbcarveinsidenonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the operation...

CVE-2026-98271 net: skbuff: do not leave stale header offsets after pskb_carve()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskbcarve pskbcarveinsideheader and pskbcarveinsidenonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the operation...

CVE-2026-98272

The Linux kernel contains a buffer overflow vulnerability in the mvpp2 driver during page_pool allocation . The issue occurs because the mvpp2_change_mtu() function may call mvpp2_bm_switch_buffers() without verifying if the number of pools (nrxqs * 2) exceeds the MVPP2_BM_MAX_POOLS limit of 8. T...

EUVD-2026-93200

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98272 net: mvpp2: prevent buffer overflow in page_pool allocation

In the Linux kernel, the following vulnerability has been resolved: net: mvpp2: prevent buffer overflow in pagepool allocation The per‑processor buffering scheme is supported only if the number of pools nrxqs 2 does not exceed MVPP2BMMAXPOOLS 8. This is already checked in mvpp2probe during the...

CVE-2026-98271 net: skbuff: do not leave stale header offsets after pskb_carve()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: do not leave stale header offsets after pskbcarve pskbcarveinsideheader and pskbcarveinsidenonlinear remove the first bytes of a packet and reallocate skb-head. All the headers that were present before the operation...

EUVD-2026-93198

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both amdgpurasgetcontext and amdgpurasfindobj can return NULL, e.g. during the...

CVE-2026-98270

The Linux kernel contains a vulnerability in the drm/amdgpu component where the function nbio_v7_9_handle_ras_controller_intr_no_bifring() dereferences ras and obj without performing NULL checks. This occurs because amdgpu_ras_get_context() and amdgpu_ras_find_obj() can return NULL during a speci...

CVE-2026-98270 drm/amdgpu: check ras and obj before dereference

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both amdgpurasgetcontext and amdgpurasfindobj can return NULL, e.g. during the...

CVE-2026-98270 drm/amdgpu: check ras and obj before dereference

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu: check ras and obj before dereference nbiov79handlerascontrollerintrnobifring dereferences ras and obj without checking either for NULL. Both amdgpurasgetcontext and amdgpurasfindobj can return NULL, e.g. during the...

CVE-2026-98269 btrfs: abort transaction on failure to update inode for hole punching and reflinking

In the Linux kernel, the following vulnerability has been resolved: btrfs: abort transaction on failure to update inode for hole punching and reflinking If we fail to update the inode we error out without aborting the transaction, which can result in a persistent inconsistency if after the failur...