CVE-2026-98442

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

CVE-2026-98442 net/sched: act_ct: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport - nfctexpectinsert -...

CVE-2026-98442

The Linux kernel contains a use-after-free (UAF) vulnerability within the traffic control connection tracking action (act_ct) . The flaw occurs because connection tracking helpers record a raw pointer to the extensions area into the expectations list before all extensions are added; if additional...

CVE-2026-98441 net/sched: act_ct: avoid modifying shared unconfirmed ct entry

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

CVE-2026-98441

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

EUVD-2026-103681

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

CVE-2026-98441

A flaw in the Linux kernel's traffic control conntrack action module (act_ct ) allows an attacker sending network traffic through affected packet filters to trigger a Denial of Service (DoS) or kernel memory corruption . The root cause is a use-after-free (UAF) condition occurring when cloned net...

CVE-2026-98441 net/sched: act_ct: avoid modifying shared unconfirmed ct entry

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up processing both again but with different sets of extensions. The series of events: 1. The...

CLSA-2024-1705927642 kernel: Fix of 8 CVEs

netsched: clsroute: remove from list when handle is 0 CVE-2022-2588 - netfilter: nftables: do not allow RULEID to refer to another chain CVE-2022-2586 - netfilter: nftables: do not allow SETID to refer to another table CVE-2022-2586 - netfilter: nftables: prevent OOB access in nftbyteordereval...

Exploit for CVE-2026-99999

CVE-2026-99999 kernel check Tools to find out whether a Linux...

CLSA-2023-1701963303 kernel: Fix of 19 CVEs

net/tls: do not free tlsrec on async operation in bpfexectxverdict CVE-2023-6176 - wifi: mac80211: fix MBSSID parsing use-after-free CVE-2022-42719 - mac80211: always allocate struct ieee80211elems CVE-2022-42719 - x86/sev: Check for user-space IOIO pointing to kernel space CVE-2023-46813 -...

CLSA-2025-1757961864 kernel: Fix of 34 CVEs

inet: fully convert sk-skrxdst to RCU rules CVE-2021-47103 - ALSA: usb-audio: Fix out of bounds reads when finding clock sources CVE-2024-53150 - posix-cpu-timers: fix race between handleposixcputimers and posixcputimerdel CVE-2025-38352 - can: peakusb: fix use after free bugs CVE-2021-47670 -...

CLSA-2024-1725872696 kernel: Fix of 43 CVEs

netfilter: nftables: use timestamp to check for set element timeout CVE-2024-27397 - x86/sev: Harden VC instruction emulation somewhat CVE-2024-25742 - bpf: Avoid uninitialized value in BPFCOREREADBITFIELD CVE-2024-42161 - selftests/bpf: Fix BPFCOREREADBITFIELD macro CVE-2024-42161 - pinctrl:...

CLSA-2026-1783414634 kernel: Fix of 14 CVEs

KVM: x86: Fix shadow paging use-after-free due to unexpected GFN/role CVE-2026-46113 - net: afkey: zero aligned sockaddr tail in PFKEY exports CVE-2026-43088 - ext4: block range must be validated before use in ext4mbclearbb CVE-2022-50021 - ext4: add strict range checks while freeing blocks...

CLSA-2024-1719933179 kernel: Fix of 19 CVEs

net: iptunnel: make sure to pull inner header in iptunnelrcv CVE-2024-26882 - net: Set true network header for ECN decapsulation CVE-2024-26882 - media: dvb-core: Fix use-after-free due to race at dvbregisterdevice CVE-2022-45884 - media: dvbdev: fix error logic at dvbregisterdevice...

CLSA-2024-1711026398 kernel: Fix of 9 CVEs

netfilter: conntrack: dccp: copy entire header to stack buffer, not just basic one CVE-2023-39197 - mtd: Fix gluebi NULL pointer dereference caused by ftl notifier CVE-2023-52449 - media: pvrusb2: fix use after free on context disconnection CVE-2023-52445 - net: prevent mss overflow in skbsegment...

CLSA-2026-1777614769 kernel: Fix of 18 CVEs

crypto: algifaead - Fix minimum RX size check for decryption - crypto: afalg - Fix page reassignment overflow in afalgpulltsgl - crypto: authencesn - Fix src offset when decrypting in-place - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption - crypto: authenc - use...

CLSA-2025-1763722365 kernel: Fix of 63 CVEs

wifi: mwifiex: Fix OOB and integer underflow when rx packets CVE-2023-53226 CVE-2023-53226 - wifi: mac80211: check S1G action frame size CVE-2023-53257 CVE-2023-53257 - wifi: cfg80211: fix use-after-free in cmpbss CVE-2025-39864 CVE-2025-39864 - partitions: mac: fix handling of bogus partition...

CLSA-2026-1780076591 kernel: Fix of 24 CVEs

scsi: target: iscsi: Fix use-after-free in iscsitdecconnusagecount CVE-2026-23216 - e1000: fix OOB in e1000tbishouldaccept CVE-2025-71093 - libceph: make decodepool more resilient against corrupted osdmaps CVE-2025-71116 - scsi: mpt3sas: Fix kernel panic during drive powercycle test...

CLSA-2026-1770032032 kernel: Fix of 63 CVEs

mm/memory-failure: fix VMBUGONPAGEPagePoisonedpage when unpoison memory CVE-2025-39883 - comedi: aioiiro16: Fix bit shift out of bounds CVE-2025-38529 - comedi: das6402: Fix bit shift out of bounds CVE-2025-38482 - comedi: pcl812: Fix bit shift out of bounds CVE-2025-38530 - comedi: das16m1: Fix...