CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74624

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

CVE-2026-74625

A memory leak vulnerability in the Linux kernel netfilter bridge component affects systems with a bridge nftables ct zone set rule. When non-IPv4 and non-IPv6 EtherType frames are processed, nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing conntrack ...

EUVD-2026-64561

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

EUVD-2026-64562

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

CVE-2026-74625

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct-lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, t...

CVE-2026-74623 net: atlantic: free stranded TX buffers on ring deinit

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aqvecdeinit drains the TX rings with a single aqringtxclean call, which frees at most AQCFGTXCLEANBUDGET 256 descriptors and stops at hwhead, which no longer moves once...

CVE-2026-74623

CVE-2026-74623 affects the Aquantia Atlantic network driver in the Linux kernel. The root cause is that aq_vec_deinit() drains TX rings with a single aq_ring_tx_clean() call limited to 256 descriptors and stops at hw_head, which no longer advances after hardware and NAPI are stopped. Completed de...

CVE-2026-74623

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aqvecdeinit drains the TX rings with a single aqringtxclean call, which frees at most AQCFGTXCLEANBUDGET 256 descriptors and stops at hwhead, which no longer moves once...

EUVD-2026-64560

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free stranded TX buffers on ring deinit aqvecdeinit drains the TX rings with a single aqringtxclean call, which frees at most AQCFGTXCLEANBUDGET 256 descriptors and stops at hwhead, which no longer moves once...

CVE-2026-74622 net: atlantic: free RX pages of consumed but not refilled buffers

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

CVE-2026-74622

CVE-2026-74622 is a resource leak in the Linux kernel's Aquantia (AQC) atlantic network driver. The function aq_ring_rx_deinit() only iterates over the [sw_head, sw_tail) region of the RX ring, but since the page reuse strategy was introduced, consumed-but-not-yet-refilled buffers reside in the c...

CVE-2026-74622

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

EUVD-2026-64559

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

CVE-2026-74622 net: atlantic: free RX pages of consumed but not refilled buffers

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

EUVD-2026-64557

In the Linux kernel, the following vulnerability has been resolved: net/sched: actgact, actpolice: range check the fallback control action tcfactioncheckctrlact range checks the primary control action: if !opcode ret = action TCACTVALUEMAX ? -EINVAL : 0; TCACTVALUEMAX is TCACTTRAP, so...

CVE-2026-74620

This Linux kernel vulnerability affects the net/sched subsystem, specifically the act_gact and act_police traffic control actions. The fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) bypass the range check in tcf_action_check_ctrlact(), allowing user space to store TC_ACT_C...