CVE-2026-98551 perf/core: Fill branch entries with a single assignment

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

CVE-2026-98551 perf/core: Fill branch entries with a single assignment

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fill branch entries with a single assignment perfclearbranchentrybitfields clears the bitfields of struct perfbranchentry one by one and leaves from/to alone, since callers overwrite those straight away. The list has t...

CVE-2026-98552

The Linux kernel contains a reference count leak in the perf/core component within the attach_perf_ctx_data() function. The vulnerability stems from a race condition between global and !global cases. When these cases race, the system may fail to set the global field, leading to a reference count ...

CVE-2026-98552 perf/core: Fix a refcount leak in attach_perf_ctx_data()

In the Linux kernel, the following vulnerability has been resolved: perf/core: Fix a refcount leak in attachperfctxdata The attachperfctxdata can race on global and !global cases. The global case is protected by globalctxdatarwsem and shares a single reference count using perfctxdata.global field...

CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98550

A flaw exists in the Linux kernel TIPC (Transparent Inter-Process Communication) subsystem where improper validation of incoming protocol messages allows an internal acknowledgment counter (bc_ackers ) to underflow. This occurs in two scenarios: when grp->bc_ackers is zero and an unexpected GR...

EUVD-2026-103595

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98550 tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow

In the Linux kernel, the following vulnerability has been resolved: tipc: reject invalid and unexpected GRPACKMSG to prevent bcackers underflow Commit 48a5fe38772b "tipc: fix bcackers underflow on duplicate GRPACKMSG" rejected duplicate/stale ACKs in tipcgroupprotorcv by returning early when...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549

A flaw in the Linux kernel TCP subsystem allows skbs queued after a transition to hardware-assisted encryption to be improperly merged with unencrypted packets in the retransmission queue. This occurs because tcp_write_collapse_fence() may fail to prevent collapsing across boundaries. Practical c...

EUVD-2026-103594

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98549 tcp: prevent collapsing skbs across boundary in rtx queue

In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcpwritecollapsefence sets TCPSKBCBskb-eor = 1 on tcpwritequeuetailsk to prevent skbs queued after a switch to device encryption from being collapsed into earlier skbs. Th...

CVE-2026-98548

A use-after-free vulnerability exists in the Linux kernel's SCTP implementation. When an association is in the COOKIE-ECHOED state and a peer sends a bundled [ERROR(Stale Cookie)][DATA] packet from a non-primary address, the processing of the ERROR chunk triggers the removal of non-primary transp...

EUVD-2026-103593

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98548 sctp: discard the rest of the packet on a stale-cookie error

In the Linux kernel, the following vulnerability has been resolved: sctp: discard the rest of the packet on a stale-cookie error When an association is in COOKIE-ECHOED state and the peer sends a bundled ERRORStale CookieDATA packet from one of its non-primary addresses, processing the ERROR chun...

CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

CVE-2026-98547

The Linux kernel is vulnerable to an integer overflow in the prb_calc_retire_blk_tmo() function within the af_packet component. The vulnerability occurs because the function performs 32-bit arithmetic when calculating mbits. A user-controlled tp_block_size (e.g., 256MiB) can cause the calculation...

CVE-2026-98547 af_packet: fix integer overflow in prb_calc_retire_blk_tmo()

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...

EUVD-2026-103592

In the Linux kernel, the following vulnerability has been resolved: afpacket: fix integer overflow in prbcalcretireblktmo prbcalcretireblktmo computes in 32-bit int arithmetic: mbits = blksizeinbytes 8 / 1024 1024; If I'm reading the validation right, tpblocksize is user controlled and...