CVE-2026-98371

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98371 xfrm: iptfs: fix runt reassembly panic from short inner tot_len

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix runt reassembly panic from short inner totlen When the start of an inner packet is split across two outer packets such that fewer than 4 bytes land at the end of the first one, inputprocesspayload saves those byt...

CVE-2026-98286 drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98286 drop_monitor: use timer_shutdown_sync() to prevent timer rearming during teardown

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

EUVD-2026-93214

In the Linux kernel, the following vulnerability has been resolved: dropmonitor: use timershutdownsync to prevent timer rearming during teardown In dropmonitor teardown paths netdmtraceoffset, netdmhwmonitorstop, and error unwind paths in netdmtraceonset and netdmhwmonitorstart, per-CPU timers ar...

CVE-2026-98286

The Linux kernel contains a vulnerability in the drop_monitor component where per-CPU timers are improperly handled during teardown paths, such as net_dm_trace_off_set(). A circular dependency between send_timer and dm_alert_work allows a worker to re-arm a timer via mod_timer following a memory ...

EUVD-2026-93187

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98259

The Linux kernel is vulnerable to a kernel panic when booting a VM with DAX enabled storage . The issue is caused by calling dax_to_folio() with an empty entry , which occurs in the fs/dax component. Specifically, the vulnerability persists in dax_associate_entry(), dax_disassociate_entry(), and ...

CVE-2026-98259 fs/dax: check zero or empty entry before converting xarray entry

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98259 fs/dax: check zero or empty entry before converting xarray entry

In the Linux kernel, the following vulnerability has been resolved: fs/dax: check zero or empty entry before converting xarray entry Calling daxtofolio with empty entry causes kernel panic below when booting a VM with DAX enabled storage. This patch checks empty entry before calling daxtofolio on...

CVE-2026-98240

The Linux kernel contains a vulnerability in the net: ip_tunnel component where options_len is used to calculate an option pointer before being initialized. This oversight leads to a buffer overflow during a memcpy operation, specifically when processing geneve_opts . This issue can trigger a ker...

CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

EUVD-2026-93168

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CVE-2026-98240 net: ip_tunnel: initialize `options_len` before referencing options

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: initialize optionslen before referencing options The following command triggers a kernel panic: ip link add d0 type dummy; ip link set d0 up ip route add 10.30.0.0/16 \ encap ip id 300 geneveopts 4660:66:11223344 d...

CLEANSTART-2026-ZF54924 incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs

CVE-2026-46597 affects multiple packages. An incorrectly placed cast from bytes to int allowed for server-side panic in the AES-GCM packet decoder for well-crafted inputs. See references for individual vulnerability details...

CLEANSTART-2026-AU10912 SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate

CVE-2026-39835 affects multiple packages. SSH servers which use CertChecker as a public key callback without setting IsUserAuthority or IsHostAuthority could be caused to panic by a client presenting a certificate. See references for individual vulnerability details...

CLEANSTART-2026-NA69133 Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints

Security vulnerability affects the temporal-server package. Certificate verification can panic when a certificate in the chain has an empty DNS name and another certificate in the chain has excluded name constraints...

CLEANSTART-2026-QS35295 Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer

Security vulnerability affects the temporal-server package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

CLEANSTART-2026-GL68033 Dial and LookupPort functions panic on Windows when provided with an input containing a NUL (0)

Security vulnerability affects the temporal-server package. The Dial and LookupPort functions panic on Windows when provided with an input containing a NUL 0...

CLEANSTART-2026-WK24368 SSH clients receiving SSH_AGENT_SUCCESS when expecting a typed response will panic and cause early termination of the client process

Security vulnerability affects the prometheus-redis-exporter-fips package. SSH clients receiving SSHAGENTSUCCESS when expecting a typed response will panic and cause early termination of the client process...