kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

kernel: svcrdma: Validate Read chunk positions before reconstruction

A flaw was found in the svcrdma component of the Linux kernel. A remote attacker can exploit this vulnerability by supplying a crafted RPC/RDMA Read chunk position field that is not properly validated against the received inline body length. This can lead to an underflow, exposing adjacent slab...

kernel: NFSD: Prevent client use-after-free during blocked-lock reaping

A flaw was found in the Linux kernel's Network File System Daemon NFSD. A use-after-free vulnerability can occur during the blocked-lock reaping process. This happens when a client's lock owner, without a proper reference to keep the client alive, leads to the client being prematurely freed. This...

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key

A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...

kernel: net/sched: cls_route: fix fastmap use-after-free on filter

A flaw was found in the Linux kernel's net/sched: clsroute component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packe...

kernel: ALSA: usx2y: bound the hwdep mmap fault offset

A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...

Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update

An update for kernel is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get

A flaw was found in the Advanced Linux Sound Architecture ALSA Sound Open Firmware SOF ipc3-control component of the Linux kernel. This vulnerability, a heap overflow, occurs due to incorrect bounds checks when handling user data lengths. An unprivileged local user can exploit this to write past...

kernel: Linux kernel: Denial of Service due to use-after-free in act_tunnel_key

A flaw was found in the Linux kernel's acttunnelkey module, which manages network traffic tunneling. A race condition, where multiple operations occur in an unpredictable order, can lead to a use-after-free vulnerability. This allows a local attacker to corrupt memory, potentially causing the...

kernel: md/raid5-ppl: fix use-after-free in ppl_do_flush()

A flaw was found in the Linux kernel. A local attacker can cause a Denial of Service DoS or potentially escalate privileges through a use-after-free vulnerability in the RAID-5 Partial Parity Log PPL component. During flush operations, the system improperly continues to access an input/output I/O...

Important: Red Hat Security Advisory: kernel-rt security, bug fix, and enhancement update

An update for kernel-rt is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

kernel: udp: fix potential use-after-free in tunnel segmentation

A flaw was found in the Linux kernel's UDP User Datagram Protocol tunnel segmentation. This vulnerability arises when the system attempts to process network packets, specifically in the skbudptunnelsegment function. An attacker could potentially exploit a use-after-free condition, where the syste...

kernel: ALSA: usx2y: bound the hwdep mmap fault offset

A flaw was found in the Advanced Linux Sound Architecture ALSA usx2y driver in the Linux kernel. A local attacker, by opening the hwdep node of an attached US-X2Y device, could exploit an unbounded memory mapping mmap fault offset. This allows read-write access to arbitrary kernel memory,...

CVE-2026-72018

CVE-2026-72018 — Linux Kernel Out-of-Bounds Write Linux Kernel • DIBS Loopback • Out-of-Bounds Write Security research and technical analysis of CVE-2026-72018. 01 — Overview CVE-2026-72018 is a Linux kernel out-of-bounds write vulnerability affecting the DIBS/ISM loopback functionality. The...

CVE-2026-43503

CVE-2026-43503 DirtyClone - PoC - SecurewithUmer POC of DirtyClone — a Linux kernel local privilege escalation vulnerability. This repository contains a working Proof of Concept that allows an unprivileged local user to gain root privileges by exploiting page-cache corruption via cloned socket...

CVE-2026-73261

Mongoose is an embedded web server and network library. Prior to 7.23, the built-in TCP/IP stack enabled by MGENABLETCPIP in src/netbuiltin.c does not reject a TCP option whose declared opts1 length exceeds the remaining option bytes. In handleopt, a NOP followed by a truncated MSS option causes...

CVE-2026-72131 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-72131 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-98169 affecting package kernel for versions less than 6.6.158.1-1

CVE-2026-98169 affecting package kernel for versions less than 6.6.158.1-1. An upgraded version of the package is available that resolves this issue...