EUVD-2026-81698

In the Linux kernel, the following vulnerability has been resolved: vxlan: fix reading neigh ha Currently arp/neighreduce read neigh ha directly which can lead to partial reads while the neigh is being updated. Use neighhasnapshot to take a stable snapshot of the address similar to...

EUVD-2026-81697

In the Linux kernel, the following vulnerability has been resolved: NFSv4.1: zero referring call lists before decoding decodecbsequenceargs allocates csarclists with kmallocobjs, so each referringcalllist starts uninitialized. decoderclist assigns rclrefcalls only when rclnrefcalls is nonzero. A...

EUVD-2026-81696

In the Linux kernel, the following vulnerability has been resolved: NFSv4.2: fix LAYOUTSTATS send buffer exhaustion encodelayoutstatsmaxsz budgets XDRQUADLENPNFSLAYOUTSTATSMAXSIZE, i.e. 256 bytes, for the layoutupdate4 body written by the layout driver. The flexfiles record can exceed that...

EUVD-2026-81962

In the Linux kernel, the following vulnerability has been resolved: bnxten: Fix call to hardware monitoring event handler The first parameter of hwmonnotifyevent is supposed to be the hardware monitoring device. The bnxt driver calls it with the platform device as first parameter instead. This AP...

EUVD-2026-81695

In the Linux kernel, the following vulnerability has been resolved: NFSv4/pnfs: key the data server cache on the NFS version nfs4pnfsdsadd keys the per-net data server cache on the multipath address set alone, and struct nfs4pnfsds records no version. That suffices for the files layout driver,...

EUVD-2026-81961

In the Linux kernel, the following vulnerability has been resolved: ptp: netc: fix period truncation and potential divide-by-zero in PEROUT The maxperiod bound in nettimerenableperout was computed as: maxperiod = u64NETCTMRDEFAULTFIPER + integralperiod; which exceeds U32MAX when integralperiod 0...

EUVD-2026-81959

In the Linux kernel, the following vulnerability has been resolved: net: sparx5: fix sleep in atomic context in MAC table access sparx5setrxmode runs with netifaddrlockbh held and iterates dev-mc via devmcsync, which per address calls sparx5mcsync / sparx5mcunsync - sparx5mactlearn /...

EUVD-2026-81960

In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...

EUVD-2026-81958

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: vmbus: Skip VMBus module cleanup for non-nested root partition The VMBus module initialization function, hvacpiinit, currently does nothing when running in the root partition and root is not nested in another VM. But...

EUVD-2026-81956

In the Linux kernel, the following vulnerability has been resolved: fuse: Fix the condition to enable over-io-uring The existing condition in fuseuringcmd is there only to avoid disabling io-uring for connections that already run with it, missing was a condition to refuse any IORINGOPURINGCMD if...

EUVD-2026-81957

In the Linux kernel, the following vulnerability has been resolved: fuse: invalidate the correct range after OAPPEND direct write fusedirectwriteiter captures pos before genericwritechecks, which moves kipos to EOF for OAPPEND writes: fusedirectwriteiter pos = iocb-kipos; / 0 user-supplied /...

EUVD-2026-81955

In the Linux kernel, the following vulnerability has been resolved: arm64: process: Fix context switching MTE store-only tag check SCTLREL1.TCSO0 is set when user opt-in for MTE store-only tag check mode. However, it is not part of SCTLRUSERMASK which imply that on context switch we never clear...

EUVD-2026-81954

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

EUVD-2026-81953

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: reject accept queue add unless BTLISTEN New sk should not be added to parent socket accept queue after last l2capsockcleanuplisten has run in l2capsockteardowncb and state set to BTCLOSED, as that can result to...

EUVD-2026-81952

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: fix race l2capsockcleanuplisten vs. putchan For L2CAP sockets without owning sk-sksocket, reading l2cappisk-chan may race against concurrent l2capsockkill - l2capsockputchan. This excludes simultaneous protoops...

EUVD-2026-81950

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btnxpuart: Validate the FW dump header length nxpprocessfwdump pulls the ACL header off the frame and then reads seqnum and buflen from a struct nxpfwdumphdr placed at skb-data, without checking that the ACL payload is...

EUVD-2026-81951

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path btmtksdiotxpacket rounds the transfer size up to the SDIO block size of 256 bytes, but hands the host controller the SKB buffer as is: err = sdiowritesbbdev-func,...

EUVD-2026-81949

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: RFCOMM: Validate MTU in rfcommapplypn to prevent infinite loop rfcommapplypn accepts the MTU value from a remote PN Parameter Negotiation frame without checking for zero. When the remote peer sends an MTU of zero, d-mt...

EUVD-2026-81948

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: do not leak an hciconn when a second LE connect is rejected createleconncomplete decides whether the failed connection is still pending by comparing it against hcilookupleconnect, which returns the first LE connection ...

EUVD-2026-81947

In the Linux kernel, the following vulnerability has been resolved: xsk: honor XDPTXMETADATA in zero-copy path The zero-copy path reads TX metadata whenever the UMEM has metadata space, even if the descriptor does not set XDPTXMETADATA. Pass descriptor options through the metadata helpers and...

EUVD-2026-81946

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix NULL deref in NIX TM tree debugfs read path rvudbgnixtmtreedisplay dereferences pfvf-sqctx without checking whether the SQ context has been allocated. Reading /sys/kernel/debug/octeontx2/nix/tmtree for a NIX LF...

EUVD-2026-81944

In the Linux kernel, the following vulnerability has been resolved: net/sched: actife: Only operate on Ethernet frames actife encapsulates/decapsulates the original Ethernet header and uses skb-dev-hardheaderlen as the length of that header. That is only correct for Ethernet devices: on a device...

EUVD-2026-81945

In the Linux kernel, the following vulnerability has been resolved: octeontx2-vf: fix workqueue and netdev race in probe/remove Initialize the VF workqueue before registernetdev so ndosetrxmode does not queue work on a NULL workqueue. Unregister the netdev before destroying the workqueue, and add...

EUVD-2026-81943

In the Linux kernel, the following vulnerability has been resolved: net: mana: Cap MSI-X vectors to the device MSI-X table size managdquerymaxresources sizes gc-nummsixusable from resp.maxmsix and the CPU count, but never from the device MSI-X table. On a 1792 vCPU M-series VM that yields 1793...

EUVD-2026-81942

In the Linux kernel, the following vulnerability has been resolved: net/rds: use wqhassleeper in rdscongmapupdated rdscongmapupdated runs after a peer's congestion map has been rewritten by rdstcpcongrecv and rdsibcongrecv, or the clear-all in the loopback and IB send-completion paths. It bumps...

EUVD-2026-81941

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix NULL deref of afxdpzcqidx on rep setup afxdpzcqidx tracks receive queues using AFXDP zero-copy and is allocated during PF/VF probe. Representors and other non-AFXDP paths leave the pointer NULL, but several call...

EUVD-2026-81940

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: fix cn20k mailbox lifetime on repeated rvumboxinit rvumboxinit is called separately for AF-PF mailboxes during probe and for AF-VF mailboxes when SR-IOV is enabled. Each call used to allocate a new ngrvu object,...

EUVD-2026-81939

In the Linux kernel, the following vulnerability has been resolved: net/sched: actskbmod: fix length calculations and avoid invalid header warnings syzbot reported a warning in skbnetworkheaderlen triggered by tcfskbmodact: !skbtransportheaderwassetskb WARNING: CPU: 0 PID: 14949 at...

EUVD-2026-81938

In the Linux kernel, the following vulnerability has been resolved: net: fix a resource leak in copynetns error handling path Currently, preinitnet does two things: 1 call nscommoninit which might fail 2 initialize resources which does not fail However, preinitnet is returning early when 1 fails,...

EUVD-2026-81937

In the Linux kernel, the following vulnerability has been resolved: net/sched: fq: add overflow bounds to quantum and initial quantum fqinit computes quantum = 2 pschedmtu and initialquantum = 10 pschedmtu with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU...

EUVD-2026-81935

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqpie: clamp default quantum to avoid signed overflow fqpieinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu retu...

EUVD-2026-81936

In the Linux kernel, the following vulnerability has been resolved: net/sched: fqcodel: clamp default quantum and mtu fqcodelinit sets q-quantum = pschedmtuqdiscdevsch without clamping. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return 0x80000000...

EUVD-2026-81934

In the Linux kernel, the following vulnerability has been resolved: net/sched: hhf: clamp quantum before hhfchange to avoid overflow hhfinit sets q-quantum = pschedmtuqdiscdevsch with no overflow check. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes weight...

EUVD-2026-81932

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

EUVD-2026-81933

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfqinit sets q-quantum = pschedmtuqdiscdevsch unsigned. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return...

EUVD-2026-81931

In the Linux kernel, the following vulnerability has been resolved: tpm: st33zp24: Return zero on status read failure st33zp24status ignores the result of the transport read and returns data even when no byte was received. The I2C transport, for example, skips i2cmasterrecv when the register-sele...

EUVD-2026-81930

In the Linux kernel, the following vulnerability has been resolved: crypto: acomp - allocate async request context when cloning ACOMPREQUESTONSTACK reserves only enough storage for the synchronous fallback. When an async implementation is selected, callers clone that stack request before retrying...

EUVD-2026-81929

In the Linux kernel, the following vulnerability has been resolved: ASoC: dapm: Fix off-by-one check on the second enum channel The sndsocdapmputenumdouble rejects item0 once it reaches e-items, but it lets item1 be equal to it. Both go on to sndsocenumitemtoval, which indexes e-values with no...

EUVD-2026-81928

In the Linux kernel, the following vulnerability has been resolved: libceph: validate banner payload length When parsing the Ceph messenger v2 protocol banner, the payloadlen field is decoded from the banner prefix. If a client sends a banner with a payloadlen of 0, the kernel sets up a 0-length...

EUVD-2026-81926

In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock "clcsock" from the proto-init hook. When socket creation fails after proto-init has run - e.g. a cgroup B...

EUVD-2026-81927

In the Linux kernel, the following vulnerability has been resolved: samples/ftrace: Fix kthreadstop on ERRPTR in ftrace-direct-multi-modify ftracedirectmultiinit assigns kthreadrun's return value to simpletsk without an ISERR check. When kthreadrun fails it returns ERRPTR-ENOMEM, but init still...

EUVD-2026-81925

In the Linux kernel, the following vulnerability has been resolved: drm/xe: Reject page faults from non-fault-mode scratch VMs Having scratch enabled does not make a VM capable of handling recoverable page faults. Allowing scratch VMs through the ASID lookup also admits dma-fence mode VMs. If suc...

EUVD-2026-81924

In the Linux kernel, the following vulnerability has been resolved: virtio-net: Ensure that TCP packets don't overflow gsosegs The user can specify any gsosize in a packet crafted with an AFPACKET PACKETVNETHDR socket, even smaller than TCPMINGSOSIZE = 8. At the same time, GSOMAXSIZE = 8 GSOMAXSE...

EUVD-2026-81922

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: skip double clone set expressions on element insert Both the dynset and newsetelem path clone the existing set expressions when setting set element expressions if no override expressions are provided. This...

EUVD-2026-81923

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: move hardware offload step after building the chain blob Allocate the chain blob before the ruleset offload to reduce chances of entering an inconsistent state where the offloaded ruleset in the nic and the...

EUVD-2026-81921

In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Don't add invalid kcontrols to LED layer The kcontrol LED state layer tries to track the all associated kcontrol elements with naive assumptions that they are readable. But one can create a write-only element that...

EUVD-2026-81920

In the Linux kernel, the following vulnerability has been resolved: net: stmmac: restore NETIPALIGN in the RX DMA offset Since the RX path was converted to zero-copy, the page pool page is handed to the stack directly as the skb head, and the offset the DMA engine writes at is what determines the...

EUVD-2026-81919

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

EUVD-2026-81918

In the Linux kernel, the following vulnerability has been resolved: slip: remove sliphangup to fix use-after-free in slipreceivebuf Jaeyoung Chung and Eulgyu Kim reported a slab-use-after-free read in slipreceivebuf when racing against tty hangup. ttyldischangup calls ld-ops-hangup while holding...

EUVD-2026-81917

In the Linux kernel, the following vulnerability has been resolved: net: fec: only stop PTP if it was initialized fecptpinit is only called when fep-bufdescex is available. However, fecprobe unconditionally calls fecptpstop on the failedinit path, and fecdrvremove unconditionally calls fecptpstop...