CVE-2026-74289 ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fibinfo in fibleafnotify. syzbot reported use-after-free in nsimfib4prepareevent. 0 The problem is that the following functions call fibinfohold / refcountinc while dumping fibinfo under RCU, which is...

CVE-2026-74289

CVE-2026-74289 (Linux kernel) : A use-after-free bug occurs when dumping IPv4 fib_info under RCUs because fib_info_hold()/refcount_inc() are called while lifetime can’t be guaranteed. Affected: nsim_fib4_prepare_event(), mlxsw_sp_router_fib4_event(), rocker_router_fib_event(), and related fib_tri...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74287 sctp: validate embedded address parameter length

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...

EUVD-2026-59434

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...

EUVD-2026-59435

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74287 sctp: validate embedded address parameter length

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...

CVE-2026-74288

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74287

The in-kernel SCTP fix validates the embedded address parameter length in INIT/ASCONF paths. Previously, sctp_verify_asconf()/sctp_verify_param() checked only the outer parameter size and allowed an embedded address length to exceed the outer bounds, enabling potential out-of-bounds reads. The re...

CVE-2026-74287

In the Linux kernel, the following vulnerability has been resolved: sctp: validate embedded address parameter length sctpverifyasconf and sctpverifyparam only validate ADDIP, DELIP, and SETPRIMARY parameters against a fixed minimum size of sizeofstruct sctpaddipparam + sizeofstruct sctpparamhdr...

CVE-2026-74288

The vulnerability CVE-2026-74288 affects the Linux kernel, specifically in the networking subsystem’s fib_rules handling. The issue arises in net: fib_rules_dump() when rocker_router_fib_event() calls fib_rule_get() during an RCU dump and encounters a dying fib_rule whose refcount is zero or bein...

CVE-2026-74288 net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

In the Linux kernel, the following vulnerability has been resolved: net: fibrules: Don't dump dying fibrule in fibrulesdump. rockerrouterfibevent calls fibruleget during RCU dump. If the fibrule is dying, refcountinc will complain about it. Let's call refcountincnotzero in fibrulesdump...

CVE-2026-74286

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

EUVD-2026-59433

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286 net: pfcp: allocate per-cpu tstats for PFCP netdevs

In the Linux kernel, the following vulnerability has been resolved: net: pfcp: allocate per-cpu tstats for PFCP netdevs PFCP uses devgettstats64 as its ndogetstats64 callback, but pfcplinksetup does not request NETDEVPCPUSTATTSTATS. The net core therefore leaves dev-tstats NULL for PFCP devices...

CVE-2026-74286

Summary: The CVE-2026-74286 issue affects the Linux kernel PFCP netdevs. The root cause is that PFCP uses dev_get_tstats64() for stats, but pfcp_link_setup() did not request NETDEV_PCPU_STAT_TSTATS, leaving dev->tstats NULL. As a result, creating a PFCP rtnetlink device could prematurely query...

CVE-2026-74284

The CVE concerns the Linux kernel net/sched sch_hfsc subsystem. A bug could cause a class to be passived twice during a single dequeue: update_vf() is invoked twice for the same class (from hfsc_qlen_notify(0,0) and then hfsc_dequeue()), and if the child qdisc is empty, a second go_passive is arm...

CVE-2026-74285

In the Linux kernel, the following vulnerability has been resolved: net: Stop leased rxq before uninstalling its memory provider netifrxqcleanupunlease tears down the memory provider that was installed on a physical RX queue through a netkit queue lease. It currently revokes the provider's DMA...

CVE-2026-74284 net/sched: sch_hfsc: Don't make class passive twice

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...