CVE-2026-98560

The Linux kernel contains a vulnerability in the net/rds component where __rds_conn_create() incorrectly computes npaths from the caller's transport before determining if a connection to a local address should be handled by the loopback transport . This mismatch causes the path init loop to alloc...

CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

EUVD-2026-103605

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

CVE-2026-98560 net/rds: size a connection's path set by the transport it ends up with

In the Linux kernel, the following vulnerability has been resolved: net/rds: size a connection's path set by the transport it ends up with rdsconncreate computes npaths from the caller's transport before it decides whether a connection to one of the host's own addresses is to be handled by the...

CVE-2026-98559

The Linux kernel contains a Use-After-Free (UAF) vulnerability in the net/smc component. The issue exists because the smcr_port_err() function traverses smc_lgr_list.list without acquiring the smc_lgr_list.lock , which allows a concurrent call to smc_lgr_terminate_sched() to free an lgr object wh...

CVE-2026-98559 net/smc: fix UAF on lgr list traversal in smcr_port_err()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcrporterr smcrporterr traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched to free an lgr while it is still being dereferenced. Hold...

EUVD-2026-103604

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcrporterr smcrporterr traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched to free an lgr while it is still being dereferenced. Hold...

CVE-2026-98559 net/smc: fix UAF on lgr list traversal in smcr_port_err()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcrporterr smcrporterr traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched to free an lgr while it is still being dereferenced. Hold...

CVE-2026-98558 net: flush skb_defer_nodes in dev_cpu_dead()

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

CVE-2026-98558

The Linux kernel contains a vulnerability where the dev_cpu_dead() function fails to flush net_hotdata.skb_defer_nodes when a CPU goes offline. This causes pending skbs to remain stranded if the offline CPU held them, potentially leading to an indefinite stall in page_pool_destroy() during networ...

EUVD-2026-103603

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

CVE-2026-98558 net: flush skb_defer_nodes in dev_cpu_dead()

In the Linux kernel, the following vulnerability has been resolved: net: flush skbdefernodes in devcpudead When a CPU goes offline, devcpudead drains its softnet queues completionqueue, outputqueue, polllist, processqueue, and inputpktqueue, but leaves nethotdata.skbdefernodes untouched. If oldcp...

CVE-2026-98557

The Linux kernel contains a vulnerability in the gve driver regarding UDP GSO packet handling. The function gve_can_send_tso() incorrectly uses skb_tcp_all_headers(), which reads the TCP header's doff field. For SKB_GSO_UDP_L4 packets (which lack a TCP header), this causes tcp_hdrlen() to read an...

CVE-2026-98557 gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gvecansendtso for UDP GSO gvecansendtso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of...

EUVD-2026-103602

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gvecansendtso for UDP GSO gvecansendtso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of...

CVE-2026-98557 gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: fix header length used by gvecansendtso for UDP GSO gvecansendtso computes how many buffers each segment of a GSO packet would span, and for this it needs the length of the headers that the device replicates in front of...

CVE-2026-98556 gve: DQO: reject TSO packets with an out of range MSS

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gvepreptso notes that the device requires the MSS to be len and gsosegs, never gsosize. Such a packet reaches gvetxfilltsoctxdesc, which puts gsosize into the mss field of the...

EUVD-2026-103601

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gvepreptso notes that the device requires the MSS to be len and gsosegs, never gsosize. Such a packet reaches gvetxfilltsoctxdesc, which puts gsosize into the mss field of the...

CVE-2026-98556 gve: DQO: reject TSO packets with an out of range MSS

In the Linux kernel, the following vulnerability has been resolved: gve: DQO: reject TSO packets with an out of range MSS gvepreptso notes that the device requires the MSS to be len and gsosegs, never gsosize. Such a packet reaches gvetxfilltsoctxdesc, which puts gsosize into the mss field of the...

CVE-2026-98556

The Linux kernel contains a vulnerability in the gve driver where TSO (TCP Segmentation Offload) packets with an out-of-range MSS (Maximum Segment Size) are not properly rejected. The gve_prep_tso() function fails to enforce the required limit of