EUVD-2026-103881

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98796 net: ethernet: mtk_eth_soc: allocate dummy netdev sooner

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: mtkethsoc: allocate dummy netdev sooner The RX rings and the shared NAPI are carried by an internal "dummy" netdev eth-dummydev. mtkprobe creates that dummy device, and adds the shared tx/rx NAPI to it, only after...

CVE-2026-98796

The Linux kernel contains a vulnerability in the mtk_eth_soc driver where the internal "dummy" netdev (used for RX rings and shared NAPI) is allocated and initialized after the MAC netdevs are registered. This creates a race condition window where netdevs are visible to the network core before th...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98795 net: sparx5: skip ptp deinit if init was skipped

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98795

The Linux kernel contains a vulnerability in the sparx5 driver where unbinding the driver can lead to a NULL pointer dereference . This occurs because sparx5_ptp_init() returns early on certain lan969x variants (due to a missing SPX5_FEATURE_PTP flag) or when no "ptp" interrupt is described, but ...

EUVD-2026-103880

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: skip ptp deinit if init was skipped sparx5ptpinit returns early on the base lan969x variants because they do not have the SPX5FEATUREPTP flag. It also returns early when no "ptp" interrupt is described. Unbinding the...

CVE-2026-98791

The Linux kernel contains a vulnerability in the net/mlx5e driver. During XSK TX queue teardown , outstanding descriptors are completed without a Completion Queue Entry (CQE). If a requested TX timestamp is missing, the completion path passes a NULL CQE to the mlx5e_xsk_fill_timestamp() function,...

CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

EUVD-2026-103876

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98791 net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

CVE-2026-98791

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix AFXDP TX timestamp teardown NULL dereference During XSK TX queue teardown, outstanding descriptors are completed without a CQE. If one requested a TX timestamp, the completion path passes that NULL CQE to...

EUVD-2026-103870

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98785 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...

CVE-2026-98786 drm/amd/display: guard dc_sink dereferences in MST mode validation

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98786

The Linux kernel contains a vulnerability in the drm/amd/display driver where dm_dp_mst_is_port_support_mode() and get_conv_frl_bw() perform NULL pointer dereferences . The issue occurs because these functions access aconnector->dc_sink without sufficient checks during MST unplug operations. S...

EUVD-2026-103871

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: guard dcsink dereferences in MST mode validation dmdpmstisportsupportmode reads aconnector-dcsink-dsccaps... for the DSC branch-throughput check, and getconvfrlbw's HDMI-PCON FRL-bandwidth path reads...

CVE-2026-98785

The Linux kernel contains a vulnerability within the drm/amd/display driver. The function dc_state_create_copy() can return NULL in the event of an allocation failure. If this occurs, dm_suspend() fails to properly abort the suspend process, allowing it to continue and return success while leavin...

CVE-2026-98785 drm/amd/display: check dc_state_create_copy() for NULL in dm_suspend

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: check dcstatecreatecopy for NULL in dmsuspend dcstatecreatecopy can return NULL on allocation failure. dmsuspend only conditionally skips dmgpuresettoggleinterrupts and continues execution, returning success...