CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98568

The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) race condition within the vxlan component. Specifically, the vxlan_na_create() function samples LL_RESERVED_SPACE() twice: once to size the reply skb and again to reserve headroom. A concurrent call to vxlan_changelink() can update...

EUVD-2026-103613

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567

The Linux kernel contains a vulnerability where netdev_set_num_tc() lowers dev->num_tc without clearing the dev->tc_to_txq[] or dev->prio_tc_map[] arrays. This allows netdev_txq_to_tc() to return a traffic class value greater than or equal to the new num_tc. When __netif_set_xps_queue() ...

EUVD-2026-103612

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98566 drm/imagination: clamp freelist reconstruction requests

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

EUVD-2026-103611

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

CVE-2026-98566 drm/imagination: clamp freelist reconstruction requests

In the Linux kernel, the following vulnerability has been resolved: drm/imagination: clamp freelist reconstruction requests The firmware reconstruction count controls accesses to the request's fixed freelist ID array and the copy into the fixed response array. Neither access currently bounds the...

CVE-2026-98566

A vulnerability exists in the Linux kernel within the drm/imagination component. The firmware reconstruction count does not currently bound accesses to the request's fixed freelist ID array and the copy into the fixed response array , potentially leading to out-of-bounds access. The fix involves ...

CVE-2026-98565 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

CVE-2026-98564

The Linux kernel contains a vulnerability in the net: dsa: mt7530 driver. The mt7530_remove_common() function disposes of per-PHY interrupt mappings while the owning regmap-irq chip remains devm-registered . This allows the regmap-irq thread to dispatch on a mapping that no longer exists, leading...

EUVD-2026-103609

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

CVE-2026-98564 net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq mt7530removecommon disposes the per-PHY interrupt mappings from .remove, but the regmap-irq chip that owns the domain is devm-registered, so its parent interrupt is only...

CVE-2026-98565

The Linux kernel contains a vulnerability where a NULL dereference occurs during the unbind of MT7531 and MT7621 devices. The root cause is that while devm_regulator_get() and regulator_enable() are guarded by the switch ID (only requesting supplies for ID_MT7530 ), the mt7530_remove() function d...

CVE-2026-98565 net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...

EUVD-2026-103610

In the Linux kernel, the following vulnerability has been resolved: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 The core and io supplies are only requested for IDMT7530: both the devmregulatorget in probe and the regulatorenable in mt7530setup are guarded by the switch i...