CVE-2026-98797

The Linux kernel is vulnerable to a slab-out-of-bounds error in taprio_enqueue() caused by a stale skb->queue_mapping value. When using skbedit, a nested transmit (such as a mirror or redirect) could set the skip_txqueue flag, which the outer transmit might incorrectly consume. If a forwarded ...

EUVD-2026-103882

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98797 net: cap skb->queue_mapping when the tx queue is picked

In the Linux kernel, the following vulnerability has been resolved: net: cap skb-queuemapping when the tx queue is picked skbedit can set skb-queuemapping and raise the per-CPU skiptxqueue flag so devqueuexmit honours the mapping. devqueuexmit cleared the flag before schhandleegress and only read...

CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

EUVD-2026-103881

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98796

The Linux kernel contains a vulnerability in the mtk_eth_soc driver where the internal "dummy" netdev (used for RX rings and shared NAPI) is allocated and initialized after the MAC netdevs are registered. This creates a race condition window where netdevs are visible to the network core before th...

CVE-2026-98795

The Linux kernel contains a vulnerability in the sparx5 driver where unbinding the driver can lead to a NULL pointer dereference . This occurs because sparx5_ptp_init() returns early on certain lan969x variants (due to a missing SPX5_FEATURE_PTP flag) or when no "ptp" interrupt is described, but ...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

EUVD-2026-103880

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98794 ipvs: filter some flags received in the backup server

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

EUVD-2026-103879

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98794 ipvs: filter some flags received in the backup server

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98794

A vulnerability in the Linux kernel allows the IPVS SYNC protocol to receive messages that could cause issues on the backup server. Specifically, the NO_CPORT+TEMPLATE combination allowed lookups for normal connections to hit templates in unpredictable ways. Additionally, the ONE_PACKET flag was ...

CVE-2026-98793

The Linux kernel contains a vulnerability in the netfilter component where the function bpf_ct_set_nat_info() fails to validate the NAT manipulation type. This allows an incorrect value to be passed to nf_nat_setup_info(), triggering a WARN_ON() signal. If panic_on_warn is not set, the system set...

CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

EUVD-2026-103878

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98792

The Linux kernel contains a vulnerability in the netfilter flowtable component where the nf_flow_offload_stats() function can schedule work to retrieve statistics while a flow is simultaneously being removed by the GC (Garbage Collection) . This issue can lead to a race condition between the GC a...