CVE-2026-64005: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INITHLISTHEAD&smcvhashinfo.ht are called after smcnlinit, protoregister and sockregister. This can lead to smcvhashinfo.ht being reset even though hash entries already exist and are...

CVE-2026-64000: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

CVE-2026-63982: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress - ethy:egress - ethx:ingress mirred loop When mirred redirects to ingress from either ingress or egress the loop state from schedmirreddev array dev is lost because of 1 the packet deferral into the...

CVE-2026-63978: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

CVE-2026-64012: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: schsfb: Replace direct dequeue call with peek and qdiscdequeuepeeked When sfb has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg illustrat...

CVE-2026-63981: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...

CVE-2026-63870: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...

PT-2026-61298

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A stack overflow occurs in the Linux kernel due to a recursion bypass in the tcf mirred act function. The function uses a counter sched mirred nest to limit recursion depth, but when the...

CVE-2026-63979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

MiracleLinux 9 : golang-1.26.3-1.el9_8 (AXSA:2026-1288:06)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1288:06 advisory. net/mail: golang: net/mail: Denial of Service via pathological email address parsing CVE-2026-42499 cmd/go: golang: Go command cmd/go: Integrity...

PT-2026-61371

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the network shaper component where the net shaper nl group doit function fails to deduplicate NET SHAPER A LEAVES entries. If a user provides the same leaf handle multip...

PT-2026-61443

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth MGMT component where the MGMT OP ADD EXT ADV DATA command fails to verify if the specified advertising data lengths are within the actual command payload...

PT-2026-61295

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/handshake component where pending requests are not properly drained during net namespace exit. This occurs because the arguments to the list splice init functi...

PT-2026-61322

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/smc module where INIT HLIST HEAD&smc v hashinfo.ht is called after smc nl init, proto register, and sock register. This sequence can cause the smc v hashinfo.h...

CVE-2026-63979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

PT-2026-61296

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the net/handshake component. The handshake req next function removes a request from the pending list and releases the hn lock before handshake nl accept doit...

CVE-2026-63980: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-53389: Use After Free

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN...

Authentication Bypass

netlicensing-mcp is vulnerable to Authentication Bypass. The vulnerability is due to the API key middleware failing to enforce authentication and falling back to the server operator's API key, which allows an unauthenticated attacker to invoke privileged MCP operations under the operator's identi...

CVE-2026-16127

A vulnerability was identified in zevorn rt-claw up to 0.2.0. This affects the function clawnetget/clawnetpost of the file claw/tools/toolnet.c of the component httprequest. Such manipulation of the argument url leads to server-side request forgery. The attack may be performed from remote. The...