CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

EUVD-2026-64352

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74665

CVE-2026-74665 affects the Linux kernel 's generic XDP (eXpress Data Path) path. When an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() updates skb->data_len but leaves skb->len with the old fragment contribution. After a fragment shrink, skb_headlen() becomes larger than...

CVE-2026-74664 net: openvswitch: reallocate update replies for mismatched IDs

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

CVE-2026-74664 net: openvswitch: reallocate update replies for mismatched IDs

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

EUVD-2026-64351

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

CVE-2026-74664

This vulnerability affects the Linux kernel's Open vSwitch (OVS) netlink flow command handling. The root cause is in ovs_flow_cmd_new(), which preallocates the reply skb sized from the request flow identifier. When a flow update request uses a UFID that misses the UFID lookup and falls back to th...

CVE-2026-74664

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovsflowcmdnew preallocates the optional reply skb before it takes ovsmutex and before it knows which existing flow will be updated. That is normally fine because the...

EUVD-2026-64349

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

EUVD-2026-64350

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

CVE-2026-74663 net/sched: reject overly deep qdisc hierarchies

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

CVE-2026-74662 inet: frags: publish queues before arming timer

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

CVE-2026-74663 net/sched: reject overly deep qdisc hierarchies

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

CVE-2026-74663

CVE-2026-74663 affects the Linux kernel in the net/sched subsystem. Deep queueing discipline (qdisc) hierarchies can cause excessive recursion in qdisc tree walkers, exhausting the kernel stack and leading to a Denial of Service via system crash. The existing loop check does not cover the create-...

CVE-2026-74663

In the Linux kernel, the following vulnerability has been resolved: net/sched: reject overly deep qdisc hierarchies Deep qdisc hierarchies can lead to excessive recursion in qdisc tree walkers and exhaust the kernel stack. The existing loop check does not cover the create-and-graft path, so a...

CVE-2026-74662

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

CVE-2026-74662 inet: frags: publish queues before arming timer

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

CVE-2026-74662

CVE-2026-74662 is a race condition in the Linux kernel 's inet: frags (IP fragmentation) subsystem. In inet_frag_create(), the fragment queue timer is armed before the queue is inserted into the fqdir rhashtable. When the namespace fragment timeout is zero or negative, the timer can fire before t...

EUVD-2026-64348

In the Linux kernel, the following vulnerability has been resolved: mac802154: fix netdev use-after-free in beacon worker mac802154beaconworker reads local-beaconreq under RCU and derives the sub-interface from the request, but then drops the RCU read lock and continues to use both sdata and the...