CVE-2026-98243 dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

EUVD-2026-93171

In the Linux kernel, the following vulnerability has been resolved: dma-buf/dma-fence: fix checking signaling bit for timeline and driver name v3 The patch "dma-buf: dma-fence: Fix potential NULL pointer dereference" changed the check to test for the ops pointer instead of the signaled bit to avo...

CVE-2026-98243

A vulnerability exists in the Linux kernel 's dma-buf/dma-fence component. A previous patch intended to prevent a NULL pointer dereference by testing the ops pointer instead of the signaled bit inadvertently removed RCU protection for many dma_fence implementations. This loss of protection can le...

EUVD-2026-93170

In the Linux kernel, the following vulnerability has been resolved: dma-buf: Fix silent overflow for phys vec to sgt In case MMIO size is bigger than 4G and peer2peer DMA goes through host bridge, we trigger a code path that assigns the total linked IOVA which is greater than 4G to mappedlen...

CVE-2026-98242

A vulnerability in the Linux kernel dma-buf subsystem allows for a silent overflow when the MMIO size exceeds 4G during peer-to-peer DMA through a host bridge. The root cause is that mapped_len was declared as a 32-bit unsigned int, causing a wrap-around when accumulating size_t lengths. This tru...

CVE-2026-98240

The Linux kernel contains a vulnerability in the net: ip_tunnel component where options_len is used to calculate an option pointer before being initialized. This oversight leads to a buffer overflow during a memcpy operation, specifically when processing geneve_opts . This issue can trigger a ker...

CVE-2026-98241

The Linux kernel is vulnerable to an out-of-bounds read in the ipv6: xfrm component. The functions xfrm6_local_rxpmtu() and xfrm6_local_error() incorrectly assume that skb->sk always points to a full IPv6 socket. In scenarios where TCP SYN-ACK packets are owned by a TCP_NEW_SYN_RECV request_so...

CVE-2026-98241 ipv6: xfrm: use full sockets in local error paths

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

EUVD-2026-93168

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

EUVD-2026-93169

In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm: use full sockets in local error paths xfrm6localrxpmtu and xfrm6localerror dereference skb-sk as if it always pointed at a full IPv6 socket. That is not guaranteed. TCP SYN-ACK skbs can be owned by a TCPNEWSYNRECV...

EUVD-2026-93167

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

CVE-2026-98239

The Linux kernel contains a use-after-free vulnerability in the lan743x network driver. The issue occurs in lan743x_rx_process_buffer() when a packet spans multiple receive buffers; specifically, lan743x_rx_trim_skb() frees fragment skb metadata on the last descriptor, but the checksum-success pa...

CVE-2026-98239 net: lan743x: fix RX checksum use-after-free

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

EUVD-2026-93166

In the Linux kernel, the following vulnerability has been resolved: net: wwan: t7xx: validate the netif index in t7xxccmnirecvskb The netif index carried in the DPMAIF PIT header is five bits wide, but ccmniinst only has room for NICDEVMAX 21 entries. t7xxccmnirecvskb indexes the array without a...

CVE-2026-98237

The Linux kernel contains a vulnerability in the mhi_wwan_mbim driver where the mhi_mbim_rx() function fails to adequately validate NDP traversal offsets. A modem that points an NDP at itself or an earlier NDP can cause an infinite loop, pinning one CPU at 100% utilization and preventing the thre...

CVE-2026-98238

The Linux kernel contains an out-of-bounds read vulnerability in the t7xx wwan driver. The t7xx_ccmni_recv_skb() function fails to perform a bounds check on the netif index carried in the DPMAIF PIT header . Because the index is five bits wide but the ccmni_inst[] array only supports up to NIC_DE...

EUVD-2026-93165

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: guard against a cyclic NDP chain The NDP traversal in mhimbimrx only stops when wNextNdpIndex is zero. Nothing requires the offsets to advance, so a modem that points an NDP at itself, or at an earlier NDP...

EUVD-2026-93164

In the Linux kernel, the following vulnerability has been resolved: net: wwan: mhiwwanmbim: check skbcopybits return value mhimbimrx ignores the return value of skbcopybits when it copies each datagram out of the NTB. The datagram offset and length come from the DPE, which is only checked to lie...

CVE-2026-98236

The Linux kernel contains a vulnerability in the mhi_wwan_mbim driver. The mhi_mbim_rx() function fails to check the return value of skb_copy_bits() when copying datagrams from the NTB . Because the DPE is only checked against the NTB boundaries, a modem can provide an offset pointing outside the...

EUVD-2026-93163

In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release tail references on DELACTION failure A batched RTMDELACTION request takes a temporary reference on each action before attempting any deletion. tcfactiondelete clears each processed slot and drops its...