CVE-2026-68471

In the Linux kernel, the following vulnerability has been resolved: wifi: ieee80211: validate MLE common info length ieee80211mlecommonsize uses the first common-info octet as the common information length for all known MLE types. However, ieee80211mlesizeok only validates that octet for Basic,...

CVE-2026-74324

Summary: CVE-2026-74324 affects Linux kernel wireless stack, specifically mt76/mt7925 testmode query handling. In mt7925_tm_query(), the response skb is copied with memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN) without validating length. MT7925_EVT_RSP_LEN is 512, so a firmware response ...

CVE-2026-74277 iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

EUVD-2026-59424

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

EUVD-2026-59299

In the Linux kernel, the following vulnerability has been resolved: seg6: validate SRH length before reading fixed fields seg6validatesrh reads fixed SRH fields such as srh-type and srh-hdrlen before checking that the supplied length covers the fixed struct ipv6srhdr fields. The BPF SEG6 encap pa...

CVE-2026-72330

The CVE-2026-72330 entry documents a Linux kernel vulnerability in the TLS data path. A peer can send a zero-length TLS application_data record (TLS 1.3 allows these as a traffic-analysis countermeasure). After decryption such a record has full_len == 0 and, in tls_sw_read_sock(), the read loop r...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

EUVD-2026-59126

In the Linux kernel, the following vulnerability has been resolved: batman-adv: mcast: avoid OOB read of numdests header Before the access to struct batadvtvlvmcasttracker's numdests, it is attempted to check whether enough space is actually in the network header. But instead of using offsetofend...

CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72114

In the Linux kernel CAN BCM subsystem, CVE-2026-72114 is due to bcm_rx_setup() not validating the frame length for RTR-reply frames configured via RX_SETUP with RX_RTR_FRAME, unlike bcm_tx_setup() which validates cf->len against CAN/CAN FD DLC limits. The vulnerability is resolved by adding va...

CVE-2026-72114 can: bcm: validate frame length in bcm_rx_setup() for RTR replies

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

CVE-2026-72065

The CVE-2026-72065 issue affects the Linux kernel networking path for mana devices: it fixes a vulnerability where the packet length reported by the NIC RX CQE could be unchecked before skb processing. The underlying problem is trusting CQE-reported lengths from the NIC and passing them to skb ha...

CVE-2026-72065 net: mana: Validate the packet length reported by the NIC

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

EUVD-2026-59023

In the Linux kernel, the following vulnerability has been resolved: net: mana: Validate the packet length reported by the NIC Validate the packet length reported in the RX CQE before passing it to skb processing. The CQE is supplied by the NIC device and should not be blindly trusted...

CVE-2026-68471

The CVE-2026-68471 entry describes a Linux kernel Wi-Fi (ieee80211) vulnerability in MLE length validation. The root cause is that ieee80211_mle_common_size() used the first common-info octet as the length for all MLE types, while ieee80211_mle_size_ok() only validated that octet for Basic, Probe...

Nmap 7.99 Denial of Service via Zero-Length TCP Option Packet

...

CVE-2026-74277: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path In iommudmamapsg, when handling PCI P2PDMA cases, the DMA length of the current scatterlist segment s is incorrectly assigned from the head entry sg-length...

CVE-2026-74460: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-72114: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: bcm: validate frame length in bcmrxsetup for RTR replies bcmtxsetup validates cf-len against the CAN/CAN FD DLC limits before installing frames for TXSETUP, but bcmrxsetup never did the same for the RTR-reply frame configure...

PT-2026-72514

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the CAKE Common Applications Kept Enhanced queuing discipline where signed overhead values are stored in an s16 type, but the adjusted packet length calculation utiliz...