EUVD-2026-108738

In the Linux kernel, the following vulnerability has been resolved: ipv4: stop route notification sizing when nexthop group shrinks Commit 680aea08e78c "net: ipv4: Emit notification when fib hardware flags are changed" added an RCU-only fibnlmsgsize call for asynchronous hardware flag...

CVE-2026-99072

A vulnerability exists in the Linux kernel networking stack related to ipv4 route notifications. The issue occurs because fib_nlmsg_size() performs an RCU-only call where fib_info_nhc() independently reloads nh->nh_grp. If RTM_NEWNEXTHOP replaces a group with fewer paths between these two oper...

EUVD-2026-108731

In the Linux kernel, the following vulnerability has been resolved: cgroup/cpuset: Handle cpu hotplug race in guaranteeactivecpus With commit 2125c0034c5d "cgroup/cpuset: Make cpuset hotplug processing synchronous", the cpuset hotplug operation becomes synchronous. That commit also removes the co...

CVE-2026-99065

The Linux kernel is affected by a CPU hotplug race condition within the cgroup/cpuset subsystem, specifically in the guarantee_active_cpus() function. The issue arises during CPU offline operations because the cpu_active_mask is updated in sched_cpu_deactivate() before cpuset_handle_hotplug() can...

CVE-2026-99060

A vulnerability exists in the Linux kernel 's mt7603 driver. The driver uses a driver-private global station WCID for frames without a station or vif, such as those injected via a monitor interface . Because this WCID is published without being passed to mt76_wcid_init(), the first injected frame...

EUVD-2026-108726

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7603: initialize global station WCID mt7603 uses a driver-private global station WCID for frames that have neither a station nor a vif, including frames injected through a monitor interface. Unlike the core global...

CVE-2026-99058

The Linux kernel contains a vulnerability in the workqueue subsystem where a NULL pointer dereference can occur during a chained work check. The current_wq_worker() function identifies a kworker , but it does not guarantee the worker is actively executing a work item; the worker->current_pwq m...

EUVD-2026-108724

In the Linux kernel, the following vulnerability has been resolved: workqueue: Fix NULL currentpwq deref in chained work check currentwqworker only tells us that %current is a kworker. It does not guarantee that the worker is currently executing a work item, as worker-currentpwq is populated only...

CVE-2026-99055

The Linux kernel contains a vulnerability where the can_map_frag() function dereferences a null pointer when processing net_iov fragments during zerocopy receive mapping . Specifically, skb_frag_page() returns NULL for a net_iov, but can_map_frag() fails to handle this, leading to a null-ptr-dere...

EUVD-2026-108850

In the Linux kernel, the following vulnerability has been resolved: tcp: reject netiov in zerocopy receive mapping hints After copying a readable prefix, receivefallbacktocopy asks tcpzerocopysethintforskb where page mapping can resume. If the next skb is unreadable, findnextmappablefrag passes i...

CVE-2026-99041

The Linux kernel contains a vulnerability in the ip6_gre module where a tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb. When mirred redirects this to a native ip6erspan device , the legacy PMTU update in ip6erspan_tunnel_xmit() incorrectly treats the metadata destination as a ...

EUVD-2026-108836

In the Linux kernel, the following vulnerability has been resolved: ip6gre: remove obsolete ERSPAN PMTU update A tc tunnelkey action can attach a METADATAIPTUNNEL dst to an skb, and mirred can redirect it to a native ip6erspan device. The legacy PMTU update in ip6erspantunnelxmit treats that...

EUVD-2026-108818

In the Linux kernel, the following vulnerability has been resolved: optee: register TEE devices only once fully initialized opteeprobe called teedeviceregister on both the client and the supplicant device before the rest of struct optee had been initialized. teedeviceregister calls cdevdeviceadd,...

CVE-2026-99024

The Linux kernel contains a vulnerability where optee_probe() calls tee_device_register() for both client and supplicant devices before the struct optee is fully initialized. Because tee_device_register() creates device nodes and links the device into the tee class, the device becomes accessible ...

EUVD-2026-108809

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hcisock: Serialize dead-device detachment Rebinding an HCI socket after its controller is unregistered can race monitor control replay and crash the kernel. hcisockbind clears hcipisk-hdev and drops the device referenc...

CVE-2026-99015

The Linux kernel contains a race condition in the Bluetooth hci_sock component where rebinding an HCI socket after a controller is unregistered can crash the kernel. The root cause is a lack of proper serialization: hci_sock_bind() clears the device reference under only the socket lock, while sen...

CVE-2026-99008

The Linux kernel contains a NULL pointer dereference vulnerability in the Bluetooth RFCOMM component. The issue occurs in rfcomm_dev_shutdown() when an RFCOMM tty is closed. Specifically, rfcomm_dev_add() adds a device to the list before registering the tty device; if registration fails, dev->...

EUVD-2026-108802

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Fix NULL ttydev dereference in rfcommdevshutdown syzbot hit a NULL pointer dereference in rfcommdevshutdown when an RFCOMM tty is closed. rfcommdevadd puts the new device on rfcommdevlist first and only then...

CVE-2026-98979

The Linux kernel contains a vulnerability where automounts can be added even when the parent mount is not in the caller's mount namespace. The issue stems from clone_private_mount() using MNT_NS_INTERNAL, which allows attach_recursive_mnt() to accept a mount point that count_mounts() subsequently...

CVE-2026-98941 ext4: don't enable large folios on encrypted inodes

In the Linux kernel, the following vulnerability has been resolved: ext4: don't enable large folios on encrypted inodes Commit 709f0f1f1bf5 "ext4: add checks for large folio incompatibilities when BS PS" disables large folios at mount time if the "encrypt" feature is set. However, enabling that...