CVE-2026-68129

In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...

CVE-2026-68128

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

CVE-2026-68128

CVE-2026-68128 affects the Linux kernel ice driver: the function ice_parser_profile_init could be fed a ptype >= 1024 via VIRTCHNL, writing past a bitmap of ICE_FLOW_PTYPE_MAX (1024) bits and causing a kernel page fault. The issue was demonstrated with a crafted VIRTCHNL_OP_ADD_RSS_CFG on an E...

CVE-2026-68128 ice: reject out-of-range ptype in ice_parser_profile_init

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

EUVD-2026-55509

In the Linux kernel, the following vulnerability has been resolved: ice: reject out-of-range ptype in iceparserprofileinit setbitrslt-ptype, prof-ptypes operates on a DECLAREBITMAP of ICEFLOWPTYPEMAX 1024 bits. Nothing prevents a malicious VF from providing ptype = 1024 through VIRTCHNL, resultin...

CVE-2026-68127 ila: reload IPv6 header after pskb_may_pull in checksum adjust

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

CVE-2026-68127

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

EUVD-2026-55508

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

CVE-2026-68127 ila: reload IPv6 header after pskb_may_pull in checksum adjust

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

EUVD-2026-55507

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154scanworker captures the scanning sub-interface under RCU and then keeps dereferencing sdata-dev after rcureadunlock and outside the rtnl -- in the failure...

CVE-2026-68126

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154scanworker captures the scanning sub-interface under RCU and then keeps dereferencing sdata-dev after rcureadunlock and outside the rtnl -- in the failure...

CVE-2026-68126

The CVE-2026-68126 vulnerability affects the Linux kernel mac802154 path by dereferencing the scanned sub-interface (sdata->dev) after the RCU read unlock and after the rtnl is dropped, leading to a use-after-free when DEL_INTERFACE or PHY removal unregisters the interface. The root cause is t...

CVE-2026-68126 mac802154: hold an interface reference across the scan worker

In the Linux kernel, the following vulnerability has been resolved: mac802154: hold an interface reference across the scan worker mac802154scanworker captures the scanning sub-interface under RCU and then keeps dereferencing sdata-dev after rcureadunlock and outside the rtnl -- in the failure...

CVE-2026-68125

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...

CVE-2026-68125

CVE-2026-68125 – mac802154: llsec vulnerability in the Linux kernel Affected component: mac802154 llsec code in the Linux kernel. Root cause: In llsec_do_decrypt_auth(), assoclen is computed as assoclen += datalen - authlen, where datalen is the bytes after the MAC header and authlen is 4, 8, or ...

EUVD-2026-55506

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...

CVE-2026-68125 mac802154: llsec: reject frames shorter than the authentication tag

In the Linux kernel, the following vulnerability has been resolved: mac802154: llsec: reject frames shorter than the authentication tag llsecdodecryptauth computes the associated-data length for the AEAD request as assoclen += datalen - authlen; where datalen is the number of bytes after the MAC...

CVE-2026-68124

Summary (CVE-2026-68124): In the Linux kernel’s MCTP serial path (mctp_serial_tty_receive_buf), a zero-length frame could cause an out-of-bounds heap write when rxlen is 0 and the parser enters STATE_DATA, allowing attacker-controlled writes after CAP_NET_ADMIN attaches the mctpserial netdev. The...

CVE-2026-68124

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

CVE-2026-68123

In the Linux kernel, the following vulnerability has been resolved: openvswitch: fix GSO userspace truncation underflow OVSACTIONATTRTRUNC currently stores a delta from the original skb length in OVSCBskb-cutlen. When a later userspace action segments a GSO skb, queuegsopackets reuses that delta...