CVE-2026-99029 net: sparx5: free the matchall entry on destroy

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

EUVD-2026-108824

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

CVE-2026-99029

The Linux kernel contains a memory leak vulnerability in the sparx5 network driver. Specifically, the function sparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for offloaded matchall filters, but sparx5_tc_matchall_destroy() removes these entries from the list without freeing the...

CVE-2026-99029 net: sparx5: free the matchall entry on destroy

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

CVE-2026-99029

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: free the matchall entry on destroy sparx5tcmatchallreplace allocates a struct sparx5mallentry for every offloaded matchall filter and adds it to sparx5-mallentries. sparx5tcmatchalldestroy removes the entry from the...

CVE-2026-99028

The Linux kernel contains a vulnerability in the xilinx axienet driver where outstanding DMA buffers are leaked during dmaengine_stop. Specifically, dmaengine_terminate_sync() aborts descriptors without executing completion callbacks, causing the driver to free only the ring shells while leaking ...

CVE-2026-99028 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

EUVD-2026-108823

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

CVE-2026-99028 net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop

In the Linux kernel, the following vulnerability has been resolved: net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop In the dmaengine path the driver pre-submits RX buffers and holds in-flight TX buffers whose SKBs are DMA-mapped by the driver and freed only in the completion...

CVE-2026-99027

In the Linux kernel, the following vulnerability has been resolved: net: team: stop reusing skb after queue override A nonzero devqueuexmit result does not return ownership of the skb. When an override port's qdisc drops it, the queue override helper used to try another port or the mode transmit ...

CVE-2026-99026

The Linux kernel contains a memory management issue in the net: team component. Specifically, when a broadcast transmission has no txable port, the bc_transmit() function returns false without consuming the original skb , yet team_xmit() returns NETDEV_TX_OK. This causes AF_PACKET sends to retain...

CVE-2026-99026 net: team: free skb when broadcast has no txable port

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

CVE-2026-99026 net: team: free skb when broadcast has no txable port

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

EUVD-2026-108821

In the Linux kernel, the following vulnerability has been resolved: net: team: free skb when broadcast has no txable port bctransmit sends the original skb through the last txable port. When no port is txable, it returns false without consuming the skb, but teamxmit still returns NETDEVTXOK...

CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

EUVD-2026-108817

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023 power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023

In the Linux kernel, the following vulnerability has been resolved: power: sequencing: pcie-m2: Fix leaking array from ofregulatorbulkgetall ofregulatorbulkgetall allocates the consumers array and hands it to the caller, who is expected to free it at an appropriate time. pwrseq-pcie-m2.c never di...

CVE-2026-99023

The Linux kernel contains a memory leak vulnerability in the pcie-m2 power sequencing driver. Specifically, the function of_regulator_bulk_get_all() allocates a consumers array and expects the caller to release it. However, the file pwrseq-pcie-m2.c failed to free this array, resulting in a memor...

CVE-2026-99021 regulator: of: fill in supply names in of_regulator_bulk_get_all()

In the Linux kernel, the following vulnerability has been resolved: regulator: of: fill in supply names in ofregulatorbulkgetall ofregulatorbulkgetall returns an array it allocated itself, and fills in only the consumer of each entry. Every other way of getting a bulk array has the supply name se...