542783 matches found
CVE-2026-97984
The Linux kernel contains a vulnerability where UDP sockets can experience a UDP length overflow when using IPV6_PMTUDISC_DO or IPV6_PMTUDISC_PROBE options. This occurs when sending a large packet over a network device with an unusually large MTU (greater than IP6_MAX_MTU), causing the 16-bit len...
EUVD-2026-86637
In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...
CVE-2026-97982 net: ethernet: cortina: Fix budget accounting
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...
EUVD-2026-86636
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...
CVE-2026-97982
The Linux kernel contains a vulnerability in the net: ethernet: cortina driver. Specifically, the gmac_rx() function incorrectly returns the remaining NAPI budget instead of the number of packets received. This causes an idle poll to report a full budget and remain scheduled. The fix involves upd...
CVE-2026-97982 net: ethernet: cortina: Fix budget accounting
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Fix budget accounting The gmacrx function returns the remaining NAPI budget, but its caller treats the return value as the number of packets received. An idle poll therefore reports a full budget and remai...
CVE-2026-97983 vduse: return compat ioctl results directly
In the Linux kernel, the following vulnerability has been resolved: vduse: return compat ioctl results directly The compat handler handles VDUSEIOTLBGETFD and VDUSEVQGETINFO, but then calls the native handler. Their different command sizes make native dispatch return -ENOIOCTLCMD. For GETFD, this...
CVE-2026-97983
The Linux kernel contains a vulnerability in the vduse component where the compat handler incorrectly calls the native handler for VDUSE_IOTLB_GET_FD and VDUSE_VQ_GET_INFO commands. Because these commands have different sizes, the native dispatch returns -ENOIOCTLCMD, which overwrites the return ...
EUVD-2026-86634
In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...
CVE-2026-97980 s390/debug: Fix NULL pointer dereference in debug_set_level()
In the Linux kernel, the following vulnerability has been resolved: s390/debug: Fix NULL pointer dereference in debugsetlevel Commit a2cec6863709 "s390/debug: Add s390dbf kernel parameter" incorrectly removed a null-id check from debugsetlevel, introducing a possible NULL pointer dereference for...
CVE-2026-97981 net: ethernet: cortina: Count dropped frames as NAPI work
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...
CVE-2026-97981
The Linux kernel contains a vulnerability in the net: ethernet: cortina driver where the RX loop only consumed the NAPI budget upon successful frame delivery. Consequently, error paths continued to consume descriptors without reducing the budget, allowing a stream of bad frames to process the ent...
EUVD-2026-86635
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...
CVE-2026-97980
The Linux kernel contains a NULL pointer dereference vulnerability within the s390/debug component. The issue was caused by the incorrect removal of a null-id check in the debug_set_level() function during the addition of the s390dbf kernel parameter. This affects debug-API users who pass uncheck...
CVE-2026-97979 ice: add missing xa_destroy for sched_node_ids
In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...
CVE-2026-97979
The Linux kernel contains a memory leak vulnerability within the ice driver. The root cause is the failure to call xa_destroy on the sched_node_ids xarray, which was embedded in the port_info structure. Because xarrays can allocate internal memory, this leads to a leak even if all elements are re...
EUVD-2026-86633
In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...
CVE-2026-97979 ice: add missing xa_destroy for sched_node_ids
In the Linux kernel, the following vulnerability has been resolved: ice: add missing xadestroy for schednodeids Commit 16dfa49406bc "ice: Introduce new parameters in iceschednode" added a schednodeids xarray to the port info structure, but never called xadestroy on it. Since xarrays can allocate...
CVE-2026-97978 eth: ice: don't dereference pointers from TP_printk()
In the Linux kernel, the following vulnerability has been resolved: eth: ice: don't dereference pointers from TPprintk After forwarding net-next during the v7.3 merge window we started seeing: TRACE EVENT ERROR: Event icetxdimwork has double dereference in TPprintk: REC-qvector-tx.txring-qindex...
CVE-2026-97977
The Linux kernel contains a Use-After-Free (UAF) vulnerability in the btusb Bluetooth driver. The issue occurs because btusb_close() and btusb_flush() use the asynchronous cancel_delayed_work() function; if btusb_rx_work() is already executing on another CPU, it continues running after the cancel...