ROS-20260925-73-0068

The vulnerability of the hidpsettimer function in the net/bluetooth/hidp/core.c module of the Linux kernel’s Bluetooth subsystem is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility...

ROS-20260925-73-0052

The vulnerability of the ovsnetdevtunnelDestroy function in the net/openvswitch/vport-netdev.c file, which is part of the Open vSwitch router support in the Linux operating system, is related to the lack of protection for sensitive data. Exploiting this vulnerability could allow an attacker to...

PT-2026-98636

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the macb mii init function. The function retains a reference returned by of get child by name for use in macb mdiobus register but only releases it during error...

PT-2026-98645

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cortina ethernet driver where the RX loop only consumes the budget when a frame is successfully delivered. Because error paths consume descriptors without reducing...

PT-2026-98646

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ethernet cortina driver where the gmac rx function returns the remaining NAPI budget instead of the number of packets received. Because the caller interprets this...

PT-2026-98652

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vhost component where cached vring pointers and IOTLB metadata are not properly invalidated when VIRTIO F ACCESS PLATFORM changes. This can lead to stale ring...

PT-2026-98653

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the vduse component where the vduse validate config function only verifies the upper bound of the vq align variable. This allows invalid values to reach vring create...

PT-2026-98672

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ets qdisc change function where it falls back to psched mtu without a minimum value for bands lacking an explicit quantum. When a crafted size table is used, qdisc...

PT-2026-98674

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A denial of service occurs when the hhf change function accepts an arbitrary quantum value from userspace. If a quantum of 1 is provided alongside a crafted size table, the qdisc pkt len...

PT-2026-98675

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A denial of service occurs in the Linux kernel when the sfq change function accepts any non-negative quantum value. By using a crafted size table, the qdisc pkt len can reach approximate...

PT-2026-98676

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A denial of service occurs in the Linux kernel when the fq pie change function accepts an arbitrary quantum value from userspace. If a user provides a quantum value of 1 along with a...

PT-2026-98679

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free race condition exists in the sample restore put function. This occurs during the concurrent teardown of TC sample rules that share the same restore context, where the...

PT-2026-98688

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A heap overflow exists in the cx82310 eth USB driver. The issue occurs when a 0xffff length sentinel is used to detect a router reboot. Because the logic falls through to the rest of the...

PT-2026-98551

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the OpenvSwitch component of the Linux kernel. The tbl mask array realloc function retires the old mask array before it is no longer reachable. Because...

PT-2026-98552

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.3-rc1 Description An issue exists in the MPLS push/pop path where skb mpls pop fails to clear the inner protocol record. This allows a stale network header offset to persist. When Open vSwitch re-pushes MPLS onto a packe...

PT-2026-98553

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the mana network driver where the RX completion queue CQ is sized to hold exactly one Completion Queue Element CQE per posted Receive Work Queue Element RX WQE. When...

PT-2026-98554

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the legacy FCS tagger within the Distributed Switch Architecture DSA implementation. The tagger calculates the Cyclic Redundancy Check CRC over skb-len bytes starting ...

PT-2026-98555

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bridge networking component where Connectivity Fault Management CFM and Multiple Registration Protocol MRP register a global br frame type. The hlist node of this...

PT-2026-98556

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where a batched RTM NEWACTION request can lead to memory and resource leaks. When replacing an existing action, the tcf idr check alloc functio...

PT-2026-98558

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the io uring/net component where buffers are overconsumed when using the MSG TRUNC flag. When a recv or recvmsg call is issued with MSG TRUNC and the incoming packet...