EUVD-2026-103879

In the Linux kernel, the following vulnerability has been resolved: ipvs: filter some flags received in the backup server While the IPVS SYNC protocol is not secure by design we can still protect the backup server from messages that can wreak havoc. This commit addresses problems from received...

CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98793

The Linux kernel contains a vulnerability in the netfilter component where the function bpf_ct_set_nat_info() fails to validate the NAT manipulation type. This allows an incorrect value to be passed to nf_nat_setup_info(), triggering a WARN_ON() signal. If panic_on_warn is not set, the system set...

CVE-2026-98793 netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

EUVD-2026-103878

In the Linux kernel, the following vulnerability has been resolved: netfilter: bpf: reject invalid NAT manipulation types As bpfctsetnatinfo is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo. This triggers the WARNON at nfnatsetupinfo and if...

CVE-2026-98792

The Linux kernel contains a vulnerability in the netfilter flowtable component where the nf_flow_offload_stats() function can schedule work to retrieve statistics while a flow is simultaneously being removed by the GC (Garbage Collection) . This issue can lead to a race condition between the GC a...

CVE-2026-98792 netfilter: flowtable: generalize pending status bit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

EUVD-2026-103877

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

CVE-2026-98792 netfilter: flowtable: generalize pending status bit

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nfflowoffloadstats can schedu...

EUVD-2026-103876

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98791

The Linux kernel contains a vulnerability in the net/mlx5e driver. During XSK TX queue teardown , outstanding descriptors are completed without a Completion Queue Entry (CQE). If a requested TX timestamp is missing, the completion path passes a NULL CQE to the mlx5e_xsk_fill_timestamp() function,...

CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98790

The Linux kernel contains a race condition between perf_event_exit_task() and perf_pending_task() during the begin_new_exec() process. This occurs because perf_event_exit_task() may be called while the PF_EXITING flag is not yet set, causing perf_sigtrap() to continue execution and trigger a WARN...

CVE-2026-98790 perf: Fix race between perf_event_exit_task() and perf_pending_task()

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

EUVD-2026-103875

In the Linux kernel, the following vulnerability has been resolved: perf: Fix race between perfeventexittask and perfpendingtask A race condition exists between perfeventexittask and perfpendingtask during beginnewexec. During beginnewexec, perfeventexittask may be called, and the PFEXITING flag ...

CVE-2026-98789

The Linux kernel contains a vulnerability in the BPF subsystem where objects can become stuck in free_by_rcu_ttrace . This occurs because do_call_rcu_ttrace() returns early when call_rcu_ttrace_in_progress is set, leaving objects in the trace buffer. Since the number of such objects is not bounde...

CVE-2026-98789 bpf: Fix objects stuck in free_by_rcu_ttrace

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...

EUVD-2026-103874

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix objects stuck in freebyrcuttrace docallrcuttrace returns early when callrcuttraceinprogress is set and leaves the objects in freebyrcuttrace. freercu frees waitingforgpttrace only and clears the flag. Hence the objects...