CVE-2026-98571

The Linux kernel contains a vulnerability in the stmmac driver where buf->page is not cleared after a page is recycled via page_pool_recycle_direct() during a napi_build_skb() failure. This stale pointer causes stmmac_rx_refill() to skip replacement allocation and incorrectly program the alrea...

CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

CVE-2026-98570

The Linux kernel contains a vulnerability in the ipv6 networking stack related to how dst_dev_overhead() handles headroom. When seg6 , ioam6 , and rpl lwtunnels request skb_cow_head() space, they may not account for sufficient headroom required by skb_mac_header_rebuild(). Specifically, when proc...

CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

EUVD-2026-103615

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

EUVD-2026-103614

In the Linux kernel, the following vulnerability has been resolved: ipgre: Reject enabling collect metadata through changelink ipgrenetlinkparms can enable collectmd on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a...

CVE-2026-98569 ip_gre: Reject enabling collect metadata through changelink

In the Linux kernel, the following vulnerability has been resolved: ipgre: Reject enabling collect metadata through changelink ipgrenetlinkparms can enable collectmd on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a...

CVE-2026-98569 ip_gre: Reject enabling collect metadata through changelink

In the Linux kernel, the following vulnerability has been resolved: ipgre: Reject enabling collect metadata through changelink ipgrenetlinkparms can enable collectmd on an existing GRE, GRETAP or ERSPAN device. Unlike newlink, changelink does not enforce metadata tunnel uniqueness. Converting a...

CVE-2026-98569

The Linux kernel contains a vulnerability in the ip_gre component where the ipgre_netlink_parms() function can incorrectly enable collect_md on existing GRE, GRETAP, or ERSPAN devices. Because changelink does not enforce metadata tunnel uniqueness, converting a non-metadata device can overwrite t...

EUVD-2026-103613

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98568

The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) race condition within the vxlan component. Specifically, the vxlan_na_create() function samples LL_RESERVED_SPACE() twice: once to size the reply skb and again to reserve headroom. A concurrent call to vxlan_changelink() can update...

CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

EUVD-2026-103612

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567

The Linux kernel contains a vulnerability where netdev_set_num_tc() lowers dev->num_tc without clearing the dev->tc_to_txq[] or dev->prio_tc_map[] arrays. This allows netdev_txq_to_tc() to return a traffic class value greater than or equal to the new num_tc. When __netif_set_xps_queue() ...

CVE-2026-98566 drm/imagination: clamp freelist reconstruction requests

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

CVE-2026-98566 drm/imagination: clamp freelist reconstruction requests

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

EUVD-2026-103611

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...