CVE-2026-63874

In the Linux kernel, CVE-2026-63874 affects the MCTP USB path (net: mctp: usb). The vulnerability arises from a race between urb completion and rx_retry cancellation during ndo_stop, which could leave an urb queued and re-schedule rx_retry_work. The fix strengthens sequencing between stopping and...

CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

EUVD-2026-45552

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

CVE-2026-63868 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

CVE-2026-63868 net: garp: fix unsigned integer underflow in garp_pdu_parse_attr

In the Linux kernel, the following vulnerability has been resolved: net: garp: fix unsigned integer underflow in garppduparseattr The receive-side GARP attribute parser computes dlen with reversed operands: dlen = sizeofga - ga-len; ga-len is the on-wire attribute length and includes the GARP...

CVE-2026-63867 mptcp: close TOCTOU race while computing rcv_wnd

In the Linux kernel, the following vulnerability has been resolved: mptcp: close TOCTOU race while computing rcvwnd The MPTCP output path access locklessly the MPTCP-level ackseq in multiple times, using possibly different values for the dataack in the DSS option and to compute the announced rcv...

PT-2026-61316

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indir table and hkey leak on get rxfh failure rss prepare get allocates the indirection table and hash key buffer via rss get data alloc, then calls ops-get rxfh to populate them. If get rxfh fails, the function...

PT-2026-61342

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict sk data ready racing with ktls rx sk psock strp data ready already checks tls sw has ctx rx and defers to psock-saved data ready when a TLS RX context is present, avoiding a conflict with the TLS strparser...

PT-2026-61343

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix DATA decrypt vs splice by copying data to buffer in recvmsg This improves the fix for CVE-2026-43500. Fix the pagecache corruption from in-place decryption of a DATA packet transmitted locally by splice by getting rid ...

PT-2026-61438

In the Linux kernel, the following vulnerability has been resolved: net: ifb: report ethtool stats over num tx queues ifb dev init allocates dp-tx private to dev-num tx queues entries via kzalloc objstxp, dev-num tx queues. Both IFB per-queue RX and TX stats live in those entries: ifb xmit update...

PT-2026-61426

In the Linux kernel, the following vulnerability has been resolved: af unix: Fix UAF read of tail-len in unix stream data wait unix stream data wait does skb peek tail&sk-sk receive queue without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the ca...

PT-2026-61147

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: add skb cow data before in-place crypto llsec do encrypt unauth, llsec do encrypt auth, llsec do decrypt unauth, and llsec do decrypt auth all perform in-place cryptographic transformations on skb data. They bui...

CVE-2026-42168

django-pyas2 through 1.2.3 is vulnerable to OS command injection via the cmdreceive and cmdsend fields on the Partner model. These fields are passed directly to os.system in pyas2/utils.py without sanitization, allowing an authenticated admin user to execute arbitrary commands on the server when ...

CVE-2026-44433

CVE-2026-44433 affects the Quicly QUIC protocol implementation used with the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying only a single byte at the largest permitted offset to obtain additional flow control credit, potentially causing memory exh...

CVE-2026-44433 Quicly is vulnerable to memory exhaustion

Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server. Prior to commit 8b178e6, an adversarial peer could send a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow control credit, which under certain...

PT-2026-60592

Name of the Vulnerable Software and Affected Versions Quicly versions prior to commit 8b178e6 Description An adversarial peer can trigger a Denial of Service by sending a STREAM frame containing a single byte at the maximum permitted offset to obtain additional flow control credit. If the...

EulerOS 2.0 SP10 : rsync (EulerOS-SA-2026-2669)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In rsync 3.0.1 through 3.4.1, receivexattr relies on an untrusted length value during a qsort call, leading to a receiver use-after-free. The victi...

CVE-2026-10665 Heap buffer overflow on WireGuard receive path via unbounded incoming packet length

In Zephyr's WireGuard subsystem subsys/net/lib/wireguard, wgprocessdatamessage in wgcrypto.c linearizes an inbound transport-data payload into a fixed pool buffer of CONFIGWIREGUARDBUFLEN bytes before decryption. The call netbuflinearizebuf-data, datalen, pkt-buffer, ..., datalen passed the...

CVE-2026-10665

CVE-2026-10665 concerns Zephyr’s WireGuard implementation (subsys/net/lib/wireguard). The flaw: wg_process_data_message() linearizes an inbound payload into a fixed pool buffer, passing the attacker-controlled data_len as both the destination capacity and copy length to net_buf_linearize, ignorin...

EulerOS 2.0 SP12 : rsync (EulerOS-SA-2026-2566)

According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an integer overflow vulnerability in the compressed-token decoder where a 32-bit signed counter is not checke...