43556 matches found
CVE-2026-97954
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...
AZL-104682 CVE-2026-97958 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Don't replay RTMGETCHAIN in tcctlchain. If a netlink socket sends RTMGETCHAIN requests repeatedly without recving the responses, tcctlchain hogs CPU and triggers Hung Task splat. 0 As caught in the stack trace,...
DEBIAN-CVE-2026-97954
In the Linux kernel, the following vulnerability has been resolved: net/rds: fix tcp stream corruption with large pages rdsmessagemappages assigns PAGESIZE bytes to every scatterlist entry, even when totallen ends in a partial page. The RDS congestion map is defined as 8192 bytes, so on systems...
DEBIAN-CVE-2026-97953
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TX descriptor availability check for TSO traffic stmmactsoxmit estimates the number of free TX descriptors required by a TSO skb as: skb-len - protohdrlen / TSOMAXBUFFSIZE + 1 which assumes the payload is split...
CVE-2026-97940
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6routeiteractive treats a walker in FWSU at the table root as already unlinked. fib6delroute can move a still-linked walker into that same state when the current leaf is the last route at...
CVE-2026-97618
In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...
DEBIAN-CVE-2026-97618
In the Linux kernel, the following vulnerability has been resolved: iouring/net: don't overconsume buffers when using MSGTRUNC When a recv/recvmsg is issued with MSGTRUNC and the incoming packet is larger than the provided buffer, the net layer returns the full length of the packet rather than th...
DEBIAN-CVE-2026-97614
In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...
AZL-104505 CVE-2026-97616 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...
CVE-2026-97613
In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...
CVE-2026-97614
In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...
CVE-2026-97616
In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...
DEBIAN-CVE-2026-97613
In the Linux kernel, the following vulnerability has been resolved: net: mana: Reserve extra CQ slot for the fence completion CQE The RX completion queue is sized to hold exactly one CQE per posted RX WQE. MANAFENCERQ makes hardware post an additional CQERXOBJECTFENCE after the packet CQEs. The...
DEBIAN-CVE-2026-97616
In the Linux kernel, the following vulnerability has been resolved: net/sched: actapi: release all action references on NEWACTION failure When a batched RTMNEWACTION request replaces an existing action, tcfidrcheckalloc takes a temporary reference on it. If a later action fails to initialize,...
DEBIAN-CVE-2026-97615
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...
CVE-2026-97615
In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...
UBUNTU-CVE-2026-97614
In the Linux kernel, the following vulnerability has been resolved: net: dsa: tagbrcm: legacy FCS: request needed tailroom The legacy FCS tagger calculates the CRC over skb-len bytes starting at skb-data. When a nonlinear skb reaches the tagger, this reads past the linear head into unrelated slab...
UBUNTU-CVE-2026-97972
In the Linux kernel, the following vulnerability has been resolved: net: macb: put the "mdio" child node reference on success macbmiiinit holds the reference returned by ofgetchildbyname for macbmdiobusregister and drops it only on the error paths, so every successful probe leaks a node reference...
UBUNTU-CVE-2026-98105
In the Linux kernel, the following vulnerability has been resolved: net: ethernet: oatc6: Improve the error recovery When oversubscribed traffic causes lot of buffer overflow errors, probably due to loss of data chunks, driver fails to find a data chunk with endvalid bit set, before it runs out o...
UBUNTU-CVE-2026-98027
In the Linux kernel, the following vulnerability has been resolved: net: dsa: mv88e6xxx: bound the policy rule dump by the caller's buffer size mv88e6xxxgetrxnfc uses rxnfc-rulecnt as the write index while dumping the policy IDR, clobbering the input value before it has been looked at. That input...