CVE-2026-98030

The Linux kernel contains a vulnerability in the net: dsa: bcm_sf2 component where the bcm_sf2_cfp_rule_get_all() function fails to check the caller's buffer size (nfc->rule_cnt) when walking the cfp.unique bitmap into rule_locs[]. Because the ETHTOOL_GRXCLSRLALL ioctl does not require CAP_NET...

CVE-2026-98029

The Linux kernel contains a vulnerability in the nfp driver where the nfp_net_get_fs_loc() function fails to check the cmd->rule_cnt when dumping entries into the rule_locs[] buffer. Because ETHTOOL_GRXCLSRLALL does not require CAP_NET_ADMIN privileges and uses a user-supplied rule_cnt to size...

CVE-2026-98028

The Linux kernel contains a vulnerability in the nfp_net_fs_add() function where a rule remains in the nn->fs.list if hardware reprogramming via nfp_net_fs_add_hw() fails. Because the counter nn->fs.count is decremented regardless of success, the list becomes one entry longer than the repor...

CVE-2026-98027

The Linux kernel contains a vulnerability in the net: dsa: mv88e6xxx driver. The mv88e6xxx_get_rxnfc() function incorrectly uses rxnfc->rule_cnt as a write index while dumping the policy IDR, which clobbers the input value representing the caller's buffer size. Because ETHTOOL_GRXCLSRLALL does...

CVE-2026-98026

The Linux kernel contains a vulnerability in the net: bridge: mcast component where the br_multicast_del_port_group function unlists a port group without using the proper RCU helper to preserve the next pointer. Consequently, the port group is freed immediately without waiting for the RCU grace p...

CVE-2026-98024

A vulnerability exists in the Linux kernel (s390/ism) where the ism_alloc_dmb() function incorrectly used kfree() instead of folio_put() during an error exit for memory allocated via folio_alloc(). This flaw could lead to slab allocator corruption . The fix involves using folio_put() and resettin...

CVE-2026-98025

A heap overflow vulnerability exists in the Linux kernel 's cx82310_eth USB network driver. The issue occurs when a router sends a reboot sentinel with a length of 0xffff. Because this specific length bypasses the standard MTU bound check , the driver fails to cap the size of the incomplete packe...

CVE-2026-98022

The Linux kernel contains a vulnerability where several subsystems (pfifo_fast , tun , and tap ) allocate ring buffers based on dev->tx_queue_len without an upper bound. An unprivileged user using unshare -Urn can set an excessively large tx_queue_len to exhaust global memory via oversized rin...

CVE-2026-98023

The Linux kernel contains a vulnerability in the VXLAN driver where it fails to prevent the configuration of dynamic FDB entries that reference a nexthop ID. Because the per-nexthop FDB list is only protected by a per-device hash lock—which is insufficient when multiple VXLAN devices share the sa...

CVE-2026-98021

The Linux kernel contains a vulnerability where rtnl_create_link() assigns IFLA_TXQLEN directly to dev->tx_queue_len without proper validation. This allows a device created with an oversized txqueuelen (e.g., 500000) to bypass the S16_MAX cap, leading to oversized ring allocations in pfifo_fas...

CVE-2026-98019

The Linux kernel contains a vulnerability in the BPF subsystem where certain functions failed to mark underlying scalar registers as precise . Specifically, check_func_arg() allowed bpf_register_is_null() for nullable arguments without marking the register as precise, and check_helper_call() enfo...

CVE-2026-98020

A vulnerability exists in the Linux kernel 's pds_core component where a race condition can occur during a BAR unmap on reset. Specifically, the error path in pdsc_map_bars() within pdsc_reset_prepare() and pdsc_reset_done() can clear or iounmap cmd_regs without holding the devcmd_lock. Additiona...

CVE-2026-98018

A vulnerability exists in the Linux kernel within the net: mctp: i3c component. The root cause is that mctp_i3c_probe() drops the busdevs_lock prematurely after finding the matching bus. This allows a concurrent I3C_NOTIFY_BUS_REMOVE event to unregister and free the bus netdev before the probe ca...

CVE-2026-98017

The Linux kernel contains a vulnerability in the net/sched component where an RTM_NEWQDISC request can cause a clsact to bind a populated shared ingress block during ->init() . If the request contains an invalid TCA_RATE , the estimator setup fails, causing the unwind process to synchronously ...

CVE-2026-98016

The Linux kernel contains a use-after-free race condition within the net/mlx5e component, specifically in the sample_restore_put() function. The vulnerability occurs during the concurrent teardown of TC sample rules sharing the same restore context; a thread may re-read restore->count after dr...

CVE-2026-98014

The Linux kernel contains a vulnerability in the net/mlx5 driver related to E-Switch functionality. During FW-fatal recovery (where dev->state == INTERNAL_ERROR), a failure in esw_update_vport_rx_mode() leaves vport->allmulti_rule intact. This causes esw_update_vport_mc_promisc() to add ent...

CVE-2026-98015

The Linux kernel contains a use-after-free vulnerability in the net/mlx5: E-Switch component within the mlx5_eswitch_termtbl_put() function. The issue arises because the tt->ref_count cleanup check occurs after the termtbl_mutex has been released, allowing a race condition where one caller fre...

CVE-2026-98013

The Linux kernel contains a vulnerability in the net/sched component within the fq_pie qdisc. The fq_pie_change() function improperly accepts any quantum value from userspace, including a value of 1. When combined with a crafted size table where qdisc_pkt_len reaches approximately 2 GiB , a quant...

CVE-2026-98011

The Linux kernel contains a vulnerability in the net/sched: hhf component where the hhf_change() function accepts an unvalidated quantum from userspace. A user with CAP_NET_ADMIN privileges can provide a quantum of 1 combined with a crafted size table to cause the deficit-refill loop to spin appr...

CVE-2026-98012

The Linux kernel contains a vulnerability in the net/sched: sfq component where the sfq_change() function fails to properly restrict the quantum value. By providing a crafted size table causing qdisc_pkt_len to reach approximately 2 GiB, an attacker can set quantum=1 to trigger a deficit-refill l...