CVE-2026-97966

The Linux kernel contains a vulnerability in the octeontx2-pf driver where HTB offload programs (NIX_AF_TLxX_TOPOLOGY) are set on QoS-allocated scheduler queues, but these queues are freed during teardown without clearing the TOPOLOGY settings. Consequently, PRIO_ANCHOR and RR_PRIO settings can p...

CVE-2026-97965

The Linux kernel contains a vulnerability in the vxlan component where a packet transmitted through a device configured with VXLAN_F_COLLECT_METADATA and VXLAN_F_GBP can cause information leakage. If the external ip_tunnel_info lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, the md pointer remains pointi...

CVE-2026-97964

The Linux kernel contains a vulnerability in the ppp_synctty component where the ppp_sync_txmunge() function fails to ensure the skb header is writable before prepending address and control bytes. This issue occurs because received skbs can reach this function through PPP channel bridging without...

CVE-2026-97962

The Linux kernel contains a vulnerability in the net/mlx5e driver where the representor vnic devlink health reporter is created and destroyed along a path not serialized by the devlink instance lock. This lack of serialization triggers a devl_assert_locked() splat during driver unbind. The issue ...

CVE-2026-97963

The Linux kernel contains a vulnerability in the stmmac driver where the ptp_lock (an rwlock) is only initialized during __stmmac_open(). Because the lock is accessed by stmmac_get_time() during tc_taprio_configure() even when the interface is down and never opened, using the uninitialized lock r...

CVE-2026-97961

The Linux kernel contains a vulnerability in the perf/core subsystem where a list corruption can occur. The issue arises because the function perf_sched_cb_dec() may attempt to remove an entry from the sched_cb_list while that list node is still in use by perf_pmu_sched_task(). This specific path...

CVE-2026-97959

The Linux kernel contains a memory leak vulnerability in the net/sched: cls_route component. When an existing filter is moved to a different top-level bucket via route4_change, the filter is unlinked from the old bucket, but the bucket is never freed. This results in stale empty buckets remaining...

CVE-2026-97960

The Linux kernel is vulnerable to a reentry issue in the perf/x86/intel component. The PEBS buffer is shared by all events on a CPU, meaning drain_pebs() must not be reentered; otherwise, an instance might observe a stale buffer state and potentially access out-of-bound memory . While most calls ...

CVE-2026-97957

The Linux kernel contains a heap buffer overflow vulnerability within the hinic driver. The issue originates in the check_mbox_seq_id_and_seg_len() function, which fails to account for the remaining buffer space when processing the last segment. Specifically, it allows a segment with seq_id=42 to...

CVE-2026-97958

The Linux kernel is vulnerable to a CPU hogging issue in net/sched: cls_api due to how tc_ctl_chain() handles repeated RTM_GETCHAIN requests. If a netlink socket sends these requests without consuming the responses, netlink_attachskb() may return -EAGAIN when the receive buffer is full, causing t...

CVE-2026-97956

The Linux kernel contains a deadlock vulnerability within the net_failover subsystem, specifically in the net_failover_slave_name_change() function. The issue arises because the function uses dev_open() in contexts where netdev_lock_ops() is present in upper callers, leading to a lock conflict. T...

CVE-2026-97955

The Linux kernel contains a vulnerability in the mana networking subsystem where the XDP program pointer is not correctly restored when RX buffer pre-allocation fails. Specifically, mana_xdp_set() publishes a new program into apc->bpf_prog before allocation; if mana_pre_alloc_rxbufs() fails, i...

CVE-2026-97954

The Linux kernel contains a vulnerability in the net/rds component where rds_message_map_pages() incorrectly assigns PAGE_SIZE bytes to every scatterlist entry, even for partial pages. On systems with a PAGE_SIZE greater than 8192 bytes, this causes the scatterlist to map bytes beyond the end of ...

CVE-2026-97953

A vulnerability exists in the Linux kernel 's stmmac driver related to the TX descriptor availability check for TSO traffic . The stmmac_tso_xmit() function incorrectly estimates the required free TX descriptors by assuming the payload is split into TSO_MAX_BUFF_SIZE chunks. This logic underestim...

CVE-2026-97952

A vulnerability exists in the Linux kernel 's sunvdc driver where a failure during __vdc_tx_trigger() causes the driver to fail to unmap LDC cookies . Because the descriptor remains in a READY state and the prod pointer is not advanced, the mapping is never released, leading to a permanent leak o...

CVE-2026-97951

The Linux kernel contains a vulnerability in the iSCSI target component where certain aborted WRITE_PENDING commands cause a hang. When a LUN_RESET aborts a WRITE command in the TRANSPORT_WRITE_PENDING state, the target core sets the CMD_T_ABORTED flag and waits for the frontend. If the initiator...

CVE-2026-97949

The Linux kernel contains a vulnerability in configfs where configfs_rmdir() fails to unhash a dentry before dropping the item. This creates a race condition because configfs_get_config_item() relies on the hashed state as proof of a live item, but simple_rmdir() only unhashes the dentry via d_de...

CVE-2026-97950

The Linux kernel contains a vulnerability in configfs where create_link() incorrectly relies on an item reference that pins the item but not its dentry. A race condition between a symlink creation and an rmdir of its target can cause configfs_remove_dir() to release the dentry via simple_rmdir() ...

CVE-2026-97947

The Linux kernel contains a vulnerability in the x86/amd_node component where amd_smn_read() and amd_smn_write() functions could trigger a NULL pointer dereference . This occurs because these functions are exported around __amd_smn_rw(), making them accessible even if amd_smn_init() fails. In suc...

CVE-2026-97948

The Linux kernel contains a vulnerability in the powerpc/eeh driver where a recursive locking issue can cause the eehd to hang. The root cause is that the pci_rescan_remove_lock is held during eeh_handle_normal_event() and eeh_reset_device(), but the code path in eeh_rmv_device() failed to remove...