CVE-2026-63995

A flaw was found in the Linux kernel's ethtool CMIS firmware update code. A malicious module or a corrupted response can provide an oversized payload size during the firmware update process. This can lead to an out-of-bounds write, allowing an attacker to corrupt memory. This memory corruption...

CVE-2026-63996

A flaw was found in the Linux kernel's ethtool CMIS Common Management Interface Specification module. A malicious SFP Small Form-Factor Pluggable module could provide a reply with a length longer than expected, leading to an out-of-bounds write. This vulnerability can result in memory corruption...

CVE-2026-63991

A flaw was found in the Linux kernel's Bluetooth 6lowpan module. This vulnerability occurs because the sendmcastpkt function does not properly check the return value of skbclone, which can be null if memory allocation fails. An attacker could exploit this by triggering a scenario where skbclone...

CVE-2026-63993

A flaw was found in the Linux kernel's Virtual Extensible LAN VXLAN module. This vulnerability occurs because a cached IP header pointer is improperly reused after a Path Maximum Transmission Unit PMTU check. When the packet's head is modified during the PMTU check, the old cached IP header point...

CVE-2026-63987

A flaw was found in the Linux kernel's ethtool subsystem. The ethnlupdateprofile function, responsible for updating profile settings, does not properly validate user-controlled input when processing Netlink nest lists. This allows a local attacker to cause an out-of-bounds write, potentially...

CVE-2026-63986

A flaw was found in the Linux kernel's ethtool: tsinfo component. This vulnerability occurs when the ethnltsinfopreparedump function fails to properly initialize a generic netlink message genlmsg but still attempts to cancel it by passing an error pointer. This improper error handling can lead to...

CVE-2026-63985

A flaw was found in the Linux kernel's ethtool component, specifically within the EEPROM Netlink fallback path. The fallbacksetparams function fails to properly validate the length of data being read from the module's EEPROM, allowing for an out-of-bounds read. Additionally, the eepromfallback...

CVE-2026-63984

A flaw was found in the Linux kernel's IPv6 Routing Protocol for Low-Power and Lossy Networks RPL segment routing header SRH decompression function, ipv6rplsrhdecompress. An integer overflow occurs when processing a specially crafted IPv6 packet, causing the header length calculation to truncate...

CVE-2026-63982

A flaw was found in the Linux kernel's network scheduler component. This vulnerability occurs when the mirred action, used for redirecting network traffic, fails to properly detect a redirection loop. An attacker can exploit this by crafting specific network configurations that cause packets to b...

CVE-2026-63983

A flaw was found in the Linux kernel's network emulator netem component. This vulnerability occurs when netem duplicates a packet and re-enqueues it, leading to a recursive packet duplication loop if multiple netem instances are configured. This uncontrolled recursion can exhaust system resources...

CVE-2026-63981

A flaw was found in the Linux kernel's net/sched: actmirred component. An unprivileged local user, by leveraging user namespaces to gain network administration capabilities, can create a specific network configuration that triggers an unbounded recursion. This recursion bypasses a depth limit...

CVE-2026-63979

A flaw was found in the Linux kernel's net/handshake component. A race condition exists where a network handshake request can be removed and its associated file reference released concurrently while the accept-side code attempts to access it. This can lead to the system attempting to read from...

CVE-2026-63980

A flaw was found in the Linux kernel's network handshake component. An improper locking mechanism, specifically the use of spinlock instead of spinlockbh in the handshakereqcancel function, can lead to a deadlock. This vulnerability occurs when a process-context thread holds a lock while a softir...

CVE-2026-63978

A flaw was found in the Linux kernel's network handshake component. When a network namespace exits, pending handshake requests may not be properly released due to incorrect list handling. This can lead to resource leaks and a list-corruption race, potentially resulting in memory corruption. An...

CVE-2026-63975

A flaw was found in the Bluetooth L2CAP Logical Link Control and Adaptation Protocol component of the Linux kernel. When a device receives a connection response with an already-assigned destination Channel Identifier CID, the system may crash. This occurs because the kernel's procedure for...

CVE-2026-63971

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

CVE-2026-63970

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

CVE-2026-63967

A flaw was found in the Linux kernel's stlsm6dsx driver. This vulnerability occurs in the tagged FIFO First-In, First-Out buffer path, where a buffer on the stack is not properly initialized. A local attacker could exploit this by reading uninitialized memory from the kernel stack, leading to...

CVE-2026-63968

A flaw was found in the Linux kernel's IPv6 networking stack. A local attacker could trigger an infinite loop within the fib6selectpath function. This occurs when a writer removes an entry from a list without proper synchronization with readers, causing the list traversal to never terminate. This...

CVE-2026-63969

A flaw was found in the Linux kernel's IPv6 networking subsystem. A local attacker could trigger an infinite loop within the rt6fillnode function. This occurs when a writer removes an entry from a list without proper synchronization, causing a softirq-side process to continuously loop. The...