377755 matches found
CVE-2026-74726 bonding: alb: re-check primary_is_promisc under RTNL in bond_alb_monitor
In the Linux kernel, the following vulnerability has been resolved: bonding: alb: re-check primaryispromisc under RTNL in bondalbmonitor bondalbmonitor reads primaryispromisc under RCU, then drops RCU and takes RTNL via rtnltrylock before undoing the promiscuity it set on the active slave. In tha...
CVE-2026-74727
A race condition in the Linux kernel's ovpn module (in-kernel OpenVPN) causes a Use-After-Free . When a peer is removed concurrently (via OVPN_CMD_PEER_DEL, keepalive expiry, or socket teardown) while ovpn_nl_peer_set_doit() or the float path (ovpn_peer_endpoints_update()) holds only a refcount, ...
CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...
EUVD-2026-64414
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...
CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...
CVE-2026-74726
A race condition in the Linux kernel's bonding module affects the Active-Backup Load Balancing (ALB) monitor (bond_alb_monitor() in drivers/net/bonding/bond_alb.c). The function reads primary_is_promisc under RCU, then drops RCU and acquires RTNL via rtnl_trylock(). In that window, the active sla...
CVE-2026-74727
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...
EUVD-2026-64412
In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...
CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal
In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...
CVE-2026-74725
A use-after-free vulnerability exists in the Linux kernel enic driver during device removal. The function enic_remove() cancels the reset and change_mtu_work items but fails to cancel tx_hang_reset. A TX timeout firing while the device is being removed can schedule enic_tx_hang_reset() to execute...
CVE-2026-74725 enic: fix tx_hang_reset use-after-free on device removal
In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...
CVE-2026-74725
In the Linux kernel, the following vulnerability has been resolved: enic: fix txhangreset use-after-free on device removal enicremove cancels the reset and changemtuwork items but does not cancel txhangreset. A TX timeout that fires while the device is being removed can schedule enictxhangreset s...
EUVD-2026-64410
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...
CVE-2026-74724
This vulnerability affects the Linux kernel's IPVS (IP Virtual Server) component, specifically the ip_vs_nat_icmp function. A local attacker with low privileges can modify a packet while it is being processed by IPVS. The root cause is that the IP IHL (Internet Header Length) field is read multip...
CVE-2026-74723 btrfs: lzo: reject inline extents without valid headers
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...
EUVD-2026-64411
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...
CVE-2026-74723
A slab-out-of-bounds read in the Linux kernel's btrfs LZO decompression path is triggered when a crafted btrfs image contains an inline LZO compressed file extent with only an LZO header but no segment header or payload. The lzo_decompress() function reads beyond the item boundary; if the extent ...
CVE-2026-74724 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...
CVE-2026-74724 ipvs: avoid out-of-bounds write in ip_vs_nat_icmp
In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...
CVE-2026-74723
In the Linux kernel, the following vulnerability has been resolved: btrfs: lzo: reject inline extents without valid headers BUG For a crafted btrfs image, the following KASAN can be triggered when reading an inline lzo compressed file extent: BUG: KASAN: slab-out-of-bounds in...