254476 matches found
CVE-2026-74751
CVE-2026-74751 is a bug in the Linux kernel's RISC-V ZBB-optimized strnlen function. The loop loads one word ahead of the aligned boundary before performing the boundary check. When the string pointer is aligned and the count is a multiple of the word size, the loop can read a full word at exactl...
CVE-2026-74750 ovpn: defer key slot crypto freeing to workqueue
In the Linux kernel, the following vulnerability has been resolved: ovpn: defer key slot crypto freeing to workqueue Key slots are released through a kref and the existing release path frees the AEAD transforms from an RCU callback. That is not safe for all crypto implementations: cryptofreeaead...
CVE-2026-74748
CVE-2026-74748 is a refcount race in the Linux kernel's netfilter ipset subsystem. The function __ip_set_put_byindex() resolves a set index under RCU but decrements the reference count only after acquiring ip_set_ref_lock. A concurrent ip_set_swap() call can interleave between these two steps, ca...
CVE-2026-74748 netfilter: ipset: fix refcount race between list:set GC and swap
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...
CVE-2026-74749
CVE-2026-74749 affects the Linux kernel 's rseq (restricted sequence) subsystem. When __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled, a granted time slice extension calls hrtimer_rearm_deferred_tif(), which in turn calls __hrtimer_rearm_deferred() — a ...
CVE-2026-74749
In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...
CVE-2026-74749 rseq: Prevent hard lockup on granted time slice extension
In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension exittousermodeloop invokes rseqgranttimesliceextension with interrupts enabled. If the extension is granted it invokes hrtimerrearmdeferredtif to ensure that a pending...
CVE-2026-74748 netfilter: ipset: fix refcount race between list:set GC and swap
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...
CVE-2026-74748
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap ipsetputbyindex resolved the index to a set pointer under RCU, then took ipsetreflock in ipsetput to decrement set-ref. ipsetswap holds that same lock while swappin...
CVE-2026-74747 ipvs: revalidate ihl to prevent out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent...
CVE-2026-74747
In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent...
CVE-2026-74747
CVE-2026-74747 affects the Linux kernel in the ipvs (IP Virtual Server) subsystem, specifically in ip_vs_nat_icmp() . After reading embedded IP headers from skb frags, the ihl field is not revalidated; a local process can modify it so that after skb_ensure_writable() a larger value is visible, ca...
CVE-2026-74747 ipvs: revalidate ihl to prevent out-of-bounds access
In the Linux kernel, the following vulnerability has been resolved: ipvs: revalidate ihl to prevent out-of-bounds access While the outer IP header is already pulled into the skb head, we must be careful and revalidate the embedded headers after reading them from the skb frags to prevent...
CVE-2026-74746
CVE-2026-74746 is a slab-use-after-free vulnerability in the Linux kernel netfilter flowtable subsystem. The root cause lies in nf_flow_table_iterate(), which treats only original-direction tuple nodes as owning entries. When the original node is published first, the garbage collector can observe...
CVE-2026-74746 netfilter: flowtable: publish GC-visible tuple last
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...
CVE-2026-74745 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...
CVE-2026-74745 eth: bnxt: avoid deadlock when canceling IRQ affinity notifier
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...
CVE-2026-74745
CVE-2026-74745 is a deadlock vulnerability in the bnxt network driver within the Linux kernel . When unregistering an IRQ affinity notifier, the driver synchronously waits for the callback while holding the netdev instance lock; the callback itself attempts to cancel work under the same lock, cau...
CVE-2026-74746 netfilter: flowtable: publish GC-visible tuple last
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...
CVE-2026-74745
In the Linux kernel, the following vulnerability has been resolved: eth: bnxt: avoid deadlock when canceling IRQ affinity notifier Unregistering IRQ affinity notifiers waits for the callback synchronously. bnxt takes the netdev instance lock in the notifier to restart the queue and cancels the wo...