CVE-2026-98596

The Linux kernel contains a vulnerability where a race condition occurs during the unregistration of a device. Specifically, when rt6_uncached_list_flush_dev() unlinks uncached routes using list_del_init(), a concurrent execution can cause list_empty() to evaluate as true prematurely. This leads ...

EUVD-2026-103641

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98596

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98596 ipv6: Fix dst leak for uncached routes.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

EUVD-2026-103640

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

CVE-2026-98595

The Linux kernel contains a vulnerability where a UDP socket bound to a specific address and port fails to remove its entry from the 4-tuple hash table after being disconnected. This occurs because __udp_disconnect() skips necessary rehash or unhash operations when specific locks like SOCK_BINDAD...

CVE-2026-98595 udp: remove a disconnected socket from the 4-tuple hash table

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

CVE-2026-98595 udp: remove a disconnected socket from the 4-tuple hash table

In the Linux kernel, the following vulnerability has been resolved: udp: remove a disconnected socket from the 4-tuple hash table A UDP socket bound to a specific address and port keeps its entry in the 4-tuple hash table after it is disconnected: sk binds to 127.0.0.1:21001 sk connects to...

CVE-2026-98594

The Linux kernel contains a vulnerability where the tg3 driver fails to properly clean up PHYLIB resources during a probe failure. Specifically, if tg3_get_invariants() registers an MDIO bus and connects a PHY for USE_PHYLIB devices, but tg3_init_one() subsequently fails, the common error path re...

CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...

EUVD-2026-103639

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...

CVE-2026-98594 tg3: clean up PHYLIB resources on probe failure

In the Linux kernel, the following vulnerability has been resolved: tg3: clean up PHYLIB resources on probe failure tg3getinvariants can register an MDIO bus and connect a PHY for USEPHYLIB devices. If tg3initone later fails, its common error path releases the mappings and netdev without undoing...

CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

CVE-2026-98593

The Linux kernel contains a NULL pointer dereference vulnerability in the s390/debug component within the debug_info_copy() function. The issue occurs when debug_register_static() fails, as it clears areas, active_pages, and active_entries while leaving the area bounds unchanged. This causes debu...

EUVD-2026-103638

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

CVE-2026-98593 s390/debug: Fix NULL pointer dereference in debug_info_copy()

In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debuginfocopy When debugregisterstatic fails, it clears areas, activepages and activeentries but leaves the area bounds unchanged. Copying such an area, either by opening its view file ...

CVE-2026-98592

The Linux kernel contains a vulnerability in the spacemit driver. The emac_tx_mem_map() function prematurely writes TX_DESC_0_OWN into ring descriptors before all fragments are successfully mapped. If emac_tx_map_frag() fails, the error path calls emac_free_tx_buf() to unmap buffers but fails to ...

CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

CVE-2026-98592 net: spacemit: clear TX descriptor on fragment mapping failure

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...

EUVD-2026-103637

In the Linux kernel, the following vulnerability has been resolved: net: spacemit: clear TX descriptor on fragment mapping failure emactxmemmap writes TXDESC0OWN into the ring descriptor for every slot beyond oldhead as soon as that slot's memset'd local copy is committed with "txdescaddr =...