CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

CVE-2026-99078 net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

EUVD-2026-108744

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry With AFXDP on a striding RQ, mlx5e defers releasing XSK buffers until an MPWQE is refilled. If XSK allocation then returns -ENOMEM, actualwqhead is not advanced an...

CVE-2026-99078

The Linux kernel contains a vulnerability in the net/mlx5e driver where AF_XDP on a striding RQ can result in stale XSK buffer releases during an MPWQE refill retry . If an XSK allocation returns -ENOMEM, the actual_wq_head is not advanced, causing a subsequent NAPI poll to retry the same WQE. Th...

CVE-2026-99056

The Linux kernel contains a race condition in the strparser component, specifically involving the teardown of the parser. The issue arises because strp_recv calls may still be in-flight when strp_done() is invoked, leading to a potential Use-After-Free (UAF) . This condition primarily affects esp...

CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

EUVD-2026-108851

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser

In the Linux kernel, the following vulnerability has been resolved: strparser: make sure strprecv isn't running before tearing down the parser The comment above strpdone claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism eg locking to...

CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

EUVD-2026-108849

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99054

A race condition exists in the Linux kernel 's tipc component because tipc_topsrv_stop() closed subscriber connections while the topology server's send and receive workqueues were still running. This allows socket callbacks and subscription events to queue additional work, potentially causing in-...

CVE-2026-99054 tipc: destroy topsrv workqueues before closing connections

In the Linux kernel, the following vulnerability has been resolved: tipc: destroy topsrv workqueues before closing connections tipctopsrvstop closed subscriber connections while the topology server's send and receive workqueues were still running. Socket callbacks and subscription events could th...

CVE-2026-99053 tipc: hold a reference to nodes found by link name

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

EUVD-2026-108848

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

CVE-2026-99053

The Linux kernel is vulnerable to a slab-use-after-free in the tipc component. The flaw exists because tipc_node_find_by_name() returns a node after dropping its RCU read lock without obtaining a reference. This creates a race condition where LINK_SET, LINK_GET, or LINK_RESET_STATS handlers may a...

CVE-2026-99053 tipc: hold a reference to nodes found by link name

In the Linux kernel, the following vulnerability has been resolved: tipc: hold a reference to nodes found by link name tipcnodefindbyname returns a node after dropping its RCU read lock without taking a reference. The LINKSET, LINKGET and LINKRESETSTATS handlers then lock and access the node,...

CVE-2026-99051 fsverity: RCU-delay the freeing of struct fsverity_info

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverityinfo fsveritygetinfo calls rhashtablelookupfast, which just uses rcureadlock and doesn't directly synchronize with fsverityremoveinfo. For the same inode this isn't a problem: its...

CVE-2026-99051

The Linux kernel contains a vulnerability in the fsverity component where __fsverity_get_info() calls rhashtable_lookup_fast() using only rcu_read_lock(), failing to directly synchronize with fsverity_remove_info(). This lack of synchronization can lead to a use-after-free condition during concur...

CVE-2026-99051 fsverity: RCU-delay the freeing of struct fsverity_info

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverityinfo fsveritygetinfo calls rhashtablelookupfast, which just uses rcureadlock and doesn't directly synchronize with fsverityremoveinfo. For the same inode this isn't a problem: its...

EUVD-2026-108846

In the Linux kernel, the following vulnerability has been resolved: fsverity: RCU-delay the freeing of struct fsverityinfo fsveritygetinfo calls rhashtablelookupfast, which just uses rcureadlock and doesn't directly synchronize with fsverityremoveinfo. For the same inode this isn't a problem: its...