CVE-2026-98291

The Linux kernel contains a vulnerability in the btintel_pcie component related to the btintel_pcie_submit_rx() function. An off-by-one bounds check error occurs because the function used frbd_index > rxq->count to guard the FRBD array access, incorrectly allowing an index equal to the coun...

EUVD-2026-93203

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Ack RX overrun interrupt correctly The RX overrun interrupt is reported in interrupt status register 4, but gmacirq acknowledges it using the RX descriptor error bit from status register 0. For GMAC0 this...

CVE-2026-98275

The Linux kernel contains a vulnerability in the cortina ethernet driver regarding how it handles the RX overrun interrupt . The gmac_irq() function incorrectly acknowledges the interrupt using the RX descriptor error bit from status register 0, instead of the bit reported in status register 4. F...

EUVD-2026-93167

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: fix RX checksum use-after-free lan743xrxprocessbuffer adds each non-first receive buffer to the head skb's fraglist. On the last descriptor, lan743xrxtrimskb linearizes the head and frees the fragment skb metadata...

CVE-2026-98239

The Linux kernel contains a use-after-free vulnerability within the lan743x network driver. The issue occurs in lan743x_rx_process_buffer() when a packet spans multiple receive buffers. Specifically, lan743x_rx_trim_skb() linearizes the head and frees the fragment metadata, but the checksum-succe...

CVE-2026-98189

The Linux kernel contains an Out-of-Bounds (OOB) write vulnerability in the wilc1000 wifi driver within the wilc_wlan_handle_isr_ext() function. The driver fails to validate the RX transfer size reported by the device's interrupt status register (up to 131,068 bytes) against the rx_buffer size, w...

SUSE CVE-2026-100071

In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before the failable slave B and interlink adds. RX handlers run in softirq...

DEBIAN-CVE-2026-100071

In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before the failable slave B and interlink adds. RX handlers run in softirq...

CVE-2026-100071

In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before the failable slave B and interlink adds. RX handlers run in softirq...

CVE-2026-100071 net: hsr: free learned nodes on device setup failure

In the Linux kernel, the following vulnerability has been resolved: net: hsr: free learned nodes on device setup failure hsrdevfinalize can fail after a lower-device RX handler has already been registered slave A is added before the failable slave B and interlink adds. RX handlers run in softirq...

CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

DEBIAN-CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

AZL-104334 CVE-2026-97595 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

UBUNTU-CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

UBUNTU-CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

CVE-2026-97990

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97990 vdpa_sim_net: check TX pull result before RX copy

In the Linux kernel, the following vulnerability has been resolved: vdpasimnet: check TX pull result before RX copy vringhiovpulliotlb returns a signed byte count. A failed TX pull is currently added to the unsigned byte counter and then passed as a sizet length to receivefilter and...

CVE-2026-97595 mac802154: fix use-after-free of sdata via queued RX frames

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

EUVD-2026-86903

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...

CVE-2026-97595

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix use-after-free of sdata via queued RX frames The RX softirq producer ieee802154subifframe queues received beacon and MAC-command frames onto local-rxbeaconlist / rxmaccmdlist and schedules a process-context worker,...