CVE-2026-98635 scsi: block: Fix zones_cond out-of-bounds write on zone report

In the Linux kernel, the following vulnerability has been resolved: scsi: block: Fix zonescond out-of-bounds write on zone report blkrevalidatediskzones sizes the zonescond array from the disk capacity and zone size, but the index used by blkrevalidatezonecond comes from the device-driven...

EUVD-2026-103666

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98621 net: gue: reject invalid REMCSUM offsets

In the Linux kernel, the following vulnerability has been resolved: net: gue: reject invalid REMCSUM offsets The REMCSUM option carries an absolute checksum start and checksum field offset. gueremcsum passes them to skbremcsumprocess, whose partial path stores offset - start in the u16...

CVE-2026-98615 eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: Set AWFLUSHMODE alongside AWFLUSH when flushing the mailbox When tearing down the FW mailbox Rx ring, fbnicmbxresetdescring writes AWCFG with FLUSH set and everything else, BME included, cleared. Clearing BME halts th...

CVE-2026-98588 bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

EUVD-2026-103633

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

CVE-2026-98588

The Linux kernel is vulnerable to an out-of-bounds write in the sockmap component. The root cause is that sock_map_alloc() fails to reject max_entries values greater than INT_MAX, while sock_map_free() uses a signed integer iterator to traverse the sks[] array. When a SOCKMAP is created with max_...

CVE-2026-98588 bpf, sockmap: Reject max_entries > INT_MAX in sock_map_alloc

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject maxentries INTMAX in sockmapalloc sockmapalloc only rejects maxentries == 0 and otherwise allows any u32 value. sockmapfree then walks the sks array with a signed int iterator: int i; for i = 0; i...

CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

EUVD-2026-103615

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

CVE-2026-98570

The Linux kernel contains a vulnerability in the ipv6 networking stack related to how dst_dev_overhead() handles headroom. When seg6 , ioam6 , and rpl lwtunnels request skb_cow_head() space, they may not account for sufficient headroom required by skb_mac_header_rebuild(). Specifically, when proc...

CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

EUVD-2026-103613

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98568

The Linux kernel contains a Time-of-Check to Time-of-Use (TOCTOU) race condition within the vxlan component. Specifically, the vxlan_na_create() function samples LL_RESERVED_SPACE() twice: once to size the reply skb and again to reserve headroom. A concurrent call to vxlan_changelink() can update...

CVE-2026-98568 vxlan: use one headroom snapshot for neighbour replies

In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlannacreate samples LLRESERVEDSPACE to size the reply skb and then samples it again to reserve headroom. A concurrent vxlanchangelink can update neededheadroom between the...

CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567

The Linux kernel contains a vulnerability where netdev_set_num_tc() lowers dev->num_tc without clearing the dev->tc_to_txq[] or dev->prio_tc_map[] arrays. This allows netdev_txq_to_tc() to return a traffic class value greater than or equal to the new num_tc. When __netif_set_xps_queue() ...

EUVD-2026-103612

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...

CVE-2026-98567 net: xps: reject an out of range traffic class

In the Linux kernel, the following vulnerability has been resolved: net: xps: reject an out of range traffic class Only the entries below dev-numtc are valid in dev-tctotxq, and dev-priotcmap may only name classes below it. netdevsetnumtc lowers dev-numtc without touching either array...