CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74287

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

EUVD-2026-59433

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286

Summary: The CVE-2026-74286 issue affects the Linux kernel PFCP netdevs. The root cause is that PFCP uses dev_get_tstats64() for stats, but pfcp_link_setup() did not request NETDEV_PCPU_STAT_TSTATS, leaving dev->tstats NULL. As a result, creating a PFCP rtnetlink device could prematurely query...

CVE-2026-74284

The CVE concerns the Linux kernel net/sched sch_hfsc subsystem. A bug could cause a class to be passived twice during a single dequeue: update_vf() is invoked twice for the same class (from hfsc_qlen_notify(0,0) and then hfsc_dequeue()), and if the child qdisc is empty, a second go_passive is arm...

CVE-2026-74285

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74284 net/sched: sch_hfsc: Don't make class passive twice

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

EUVD-2026-59431

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

EUVD-2026-59432

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74285 net: Stop leased rxq before uninstalling its memory provider

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74285

CVE-2026-74285 describes a Linux kernel issue where netif_rxq_cleanup_unlease() tear-down inverted the sequence: it uninstalls the memory provider (clearing dma_addr) before stopping the physical RX queue, allowing a window for DMA to stale/zero addresses via an active queue. The fix swaps the or...

CVE-2026-74285 net: Stop leased rxq before uninstalling its memory provider

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74284 net/sched: sch_hfsc: Don't make class passive twice

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

CVE-2026-74282

In the Linux kernel vulnerability CVE-2026-74282, the TIPC stack allows an oversized CONN_ACK to cause snt_unacked to underflow. The root cause is tipc_sk_conn_proto_rcv() subtracting the peer-supplied ack count from an unsigned 16-bit snt_unacked without ensuring it does not exceed the outstandi...

CVE-2026-74283 tipc: require net admin for TIPCv2 netlink mutators

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...

CVE-2026-74282 tipc: prevent snt_unacked underflow on CONN_ACK

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

CVE-2026-74282

In the Linux kernel, the following vulnerability has been resolved: tipc: prevent sntunacked underflow on CONNACK tipcskconnprotorcv subtracts the peer-supplied connection ack count from the unsigned 16-bit send counter sntunacked without checking that it does not exceed the number of messages...

EUVD-2026-59430

In the Linux kernel, the following vulnerability has been resolved: tipc: require net admin for TIPCv2 netlink mutators TIPCv2 registers mutating generic-netlink operations without admin permission flags. Generic netlink only checks CAPNETADMIN when an operation sets GENLADMINPERM or...