Linux Kernel CVEs: What to Patch by Device (8 – 14 Nov 2026)

This week has only 4 Linux kernel CVEs. That is the lowest count in this series so far. Last week had 71. All 4 records were published on 10 November. The week is small, but one record matters to almost every product. CVE-2026-99288 is in the TCP receive path, and the record shows a kernel crash caused by incoming traffic. The two Xen records matter only to Xen hosts. The netfilter record matters to systems that load nftables rules. None of the 4 records has a CNA score.

The one action: update to the fixed version for your branch

Run uname -r and find your branch in the table. If your version is lower than the value in the second column, plan the update. Each value is the highest fixed version named by any record this week for that branch. The values for 6.12, 6.18 and 7.3 equal the newest releases on kernel.org on 14 November 2026.

raghu@techveda.org:~$ uname -r
6.12.116

The output above is an example. 6.12.116 is below 6.12.117, so that system needs the update.

Branches that are not listed were not affected, or are not maintained. On 5.10, 5.15, 6.1 and 6.6, the records list affected ranges but no fix, and the newest releases on those branches are from 6 November. If your product is on one of these branches and accepts TCP connections, check the next stable release for the CVE-2026-99288 fix. If you need it sooner, ask your kernel vendor about a backport.

Mobile and automotive

Phones, cars and wearables use Bluetooth, Wi-Fi, the TCP/IP stack and vendor system-on-chip (SoC) drivers. No record this week is in Bluetooth, Wi-Fi or a SoC driver. Two records still apply. CVE-2026-99288 applies to a head unit, telematics unit or phone that accepts incoming TCP connections. It is described in the embedded section. CVE-2026-99285 applies to an in-vehicle gateway that uses nftables rules. It is also described in the embedded section.

Embedded and IoT

Gateways, routers, cameras and industrial controllers usually run a network service and a firewall. The two records below apply to those parts.

CVE-2026-99288: TCP lookup returns a socket that is not hashed

The kernel finds the socket for an incoming TCP packet with a lockless lookup. The socket memory can be reused while a reader still holds the old address. After a match, __inet_lookup_established() and __inet6_lookup_established() take a reference and check the address pair again. They do not check that the object is still in the hash table. So the lookup can return a new socket that is not hashed. The record shows the result: a NULL pointer dereference in tcp_v4_rcv() and a kernel panic. The developers reproduced the crash with SYN cookie request sockets. The trigger is incoming network traffic, so any device that accepts TCP connections is in scope. This includes a web interface, an MQTT broker or an SSH server. The code is built on every kernel with CONFIG_INET, and the IPv6 path with CONFIG_IPV6. The bug exists since 4.4. Fixes are in 6.12.117, 6.18.63, 7.3.4 and mainline 7.4-rc2. The record lists no fix for 5.10, 5.15, 6.1, 6.6 or 7.2. The record gives no score. See the cve.org record.

CVE-2026-99285: nf_tables byteorder conversion over several registers

The nf_tables byteorder expression can convert several registers in one step. For 64-bit values the source array moves in 4-byte steps instead of 8, so the conversion is wrong. The fix removes the multi-register feature. The record does not describe memory corruption. It matters to gateways and routers that use nftables. Loading rules needs the CAP_NET_ADMIN capability, so this is a configuration-level issue. The record also says that rulesets made by nftables userspace older than 1.1.0 can fail to load after the fix. Test your firewall rules before you ship the update. The code is built with CONFIG_NF_TABLES. The problem starts in mainline 6.7 and in stable at 5.10.210, 5.15.140, 6.1.64 and 6.6.3. Fixes are in 6.12.115, 6.18.59 and mainline 7.1. The record lists no fix for 5.10, 5.15, 6.1 or 6.6. The record gives no score. See the cve.org record.

Cloud and datacenter

Servers and virtual machine hosts run the TCP stack at scale, and some hosts use Xen. Every server should apply CVE-2026-99288, which is described in the embedded section. The two Xen records below apply only to hosts that run the Xen network backend.

CVE-2026-99286: Xen network backend cleanup after a failed connection (XSA-531)

The Xen network backend in dom0 or a driver domain connects to the network frontend of each guest. When the connection fails, the cleanup path must clear vif->num_queues before it waits for readers. It did not. A later reader such as xenvif_get_stats can then access queues that are no longer valid. The affected ranges start at last week’s Xen backend releases: 5.10.274, 5.15.225, 6.1.192, 6.6.162, 6.12.116, 6.18.62, 7.3.3 and mainline 7.4-rc2. Fixes are in 6.12.117, 6.18.63 and 7.3.4. The record lists no fix for 5.10, 5.15, 6.1, 6.6 or mainline. The code is built with CONFIG_XEN_NETDEV_BACKEND. Guests and hosts that do not run the backend are not affected. The record gives no score. See the cve.org record and the Xen advisory.

CVE-2026-99287: Xen network backend unmaps the guest rings twice (XSA-532)

When the backend fails to map the data rings of a guest frontend, it unmaps the rings that were already mapped. It keeps the ring pointers. The cleanup path then unmaps the same pointers a second time. The fix sets the pointers to zero after the unmap. The code is built with CONFIG_XEN_NETDEV_BACKEND. The bug exists since 5.5. Fixes are in 6.12.117, 6.18.63 and 7.3.4. The record lists no fix for 5.10, 5.15, 6.1, 6.6, 7.2 or mainline. The record gives no score. See the cve.org record and the Xen advisory.

Container and VM hosts that use nftables should also read CVE-2026-99285 in the embedded section.

Medical devices

Connected medical devices matter for this list when they use Bluetooth, TCP/IP, USB or network file systems. This week only TCP/IP applies. CVE-2026-99288 applies to any connected device that accepts TCP connections, for example a device that receives DICOM images or HL7 and FHIR messages. No record this week is in Bluetooth, USB or a network file system. Medical-device patching is gated by validation and regulatory revalidation (US FDA postmarket cybersecurity guidance, EU MDR and IEC 62304), so the action is to plan the stable update through the manufacturer’s change-control process.

How to check if a CVE applies to you

Ask three questions in this order.

• Version. Run uname -r and compare the result with the table. If it is lower than the value for your branch, the CVEs in this post may apply. On 5.10, 5.15, 6.1 and 6.6 every current release is affected.
• Configuration. Check that your kernel builds the code. This week three build options decide it:

raghu@techveda.org:~$ zcat /proc/config.gz | grep -E 'CONFIG_INET=|CONFIG_NF_TABLES=|CONFIG_XEN_NETDEV_BACKEND='
CONFIG_INET=y
CONFIG_NF_TABLES=m
# CONFIG_XEN_NETDEV_BACKEND is not set

The output above is an example. In this example the system needs the TCP fix and the nf_tables fix, but not the Xen fixes.

• Reachability. This sets the order. Remote or over-the-air reach comes first, then local unprivileged users, then guest-to-host on shared hosts, then privileged or configuration-only paths. This week CVE-2026-99288 is remote, the two Xen records are on the host side of the guest connection, and CVE-2026-99285 is configuration-only.

Key takeaways

• 4 Linux kernel CVEs were published from 8 to 14 November 2026. None was rejected. None has a CNA score, so none is CRITICAL or HIGH.
• Update to at least 6.12.117, 6.18.63 or 7.3.4. These equal the newest kernel.org releases.
• CVE-2026-99288 is in the TCP receive path and applies to almost every networked product. Give it the highest priority.
• 5.10, 5.15, 6.1 and 6.6 have no fixed release yet. Watch for the next stable release on those branches.
• The two Xen records (CVE-2026-99286, CVE-2026-99287) apply only to hosts that run the Xen network backend.
• Medical devices: plan the stable update through the manufacturer’s change-control and revalidation process.

Frequently asked questions about this week’s Linux kernel CVEs

How many Linux kernel CVEs were published from 8 to 14 November 2026?
NVD lists 4 records for the kernel CNA in that window, and none was rejected. The lore.kernel.org announcement list shows the same 4 announcements.

Is any of this week’s CVEs CRITICAL?
No. None of the 4 records carries a CNA score, so none is CRITICAL or HIGH.

Which kernel version do I need?
Update to at least 6.12.117, 6.18.63 or 7.3.4 for your branch. 7.2 is end of life, so move to 7.3.4. On 5.10, 5.15, 6.1 and 6.6 there is no fixed release yet.

Are any of these CVEs being exploited?
No record says a bug is being exploited. The TCP record says the developers reproduced the crash in a test. The action is to schedule the stable update.

Is CVE-2026-99286 related to last week’s Xen records?
CVE-2026-99286 lists 5.10.274, 5.15.225, 6.1.192, 6.6.162, 6.12.116, 6.18.62 and 7.3.3 as the first affected versions. Those are the same releases that fixed last week’s Xen backend records. The record does not name the change that caused the new problem. It is fixed in 6.12.117, 6.18.63 and 7.3.4.

Further reading

• linux-cve-announce archive on lore.kernel.org
• cve.org record search
• National Vulnerability Database
• kernel.org releases
• Xen security advisories
• Linux Kernel CVEs: What to Patch by Device (1 – 7 Nov 2026)