45080 matches found
CVE-2026-90065
In the Linux kernel, the following vulnerability has been resolved: net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure IPPROTOSMC sockets create an internal TCP sock "clcsock" from the proto-init hook. When socket creation fails after proto-init has run - e.g. a cgroup B...
AZL-102933 CVE-2026-90058 affecting package kernel for versions less than 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...
CVE-2026-90058
In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...
CVE-2026-90319 rapidio: clear mport->net when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...
EUVD-2026-81980
In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...
CVE-2026-90319 rapidio: clear mport->net when rio_add_net() fails
In the Linux kernel, the following vulnerability has been resolved: rapidio: clear mport-net when rioaddnet fails rioallocnet stores the newly allocated rionet in mport-net before rioscanallocnet registers the device. If rioaddnet fails, rioscanallocnet drops the device reference with putdevice,...
CVE-2026-90319
CVE-2026-90319 affects the RapidIO (rio) subsystem in the Linux kernel . The root cause is a use-after-free / double-free bug: when rio_add_net() fails during device registration, rio_scan_alloc_net() releases the allocated rio_net object via put_device(), but the mport->net pointer is left da...
CVE-2026-90114 net: bridge: Reject descending VLAN tunnel ranges
In the Linux kernel, the following vulnerability has been resolved: net: bridge: Reject descending VLAN tunnel ranges A pair of descending VLAN and tunnel IDs can pass the tunnel range span check. The VLAN subtraction produces a negative int, which is converted to unsigned when compared with the...
EUVD-2026-81702
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...
CVE-2026-90109 net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue
In the Linux kernel, the following vulnerability has been resolved: net: sched: fix 32-bit backlog wrap in gred, bfifo and plug enqueue gredenqueue, bfifoenqueue and plugenqueue admit a packet when the current backlog plus the packet length fits within the queue limit: sch-qstats.backlog +...
CVE-2026-90107 net/smc: free pending qentry in smc_llc_flow_stop() before memset
In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...
CVE-2026-90108 net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...
CVE-2026-90108
CVE-2026-90108 is a memory leak in the Linux kernel 's net/smc subsystem. When smc_llc_event_handler() transitions the local LLC flow from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK, it overwrites flow->qentry via smc_llc_flow_qentry_set() without first freeing a previously stashed ent...
EUVD-2026-81700
In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...
EUVD-2026-81701
In the Linux kernel, the following vulnerability has been resolved: net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition When smcllceventhandler transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls...
CVE-2026-90107
CVE-2026-90107 is a memory leak in the Linux kernel's SMC (Shared Memory Communications) module, specifically in smc_llc_flow_stop(). A blind memset zeroes the flow struct without first freeing a potentially non-NULL flow->qentry pointer. The leak is triggered when a late-arriving duplicate CO...
CVE-2026-90107 net/smc: free pending qentry in smc_llc_flow_stop() before memset
In the Linux kernel, the following vulnerability has been resolved: net/smc: free pending qentry in smcllcflowstop before memset smcllcflowstop resets a flow struct with a blind memset: spinlockbh&lgr-llcflowlock; memsetflow, 0, sizeofflow; flow-type = SMCLLCFLOWNONE; spinunlockbh&lgr-llcflowlock...
CVE-2026-90099 net/sched: account classifier filter allocations to memcg
In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...
CVE-2026-90099 net/sched: account classifier filter allocations to memcg
In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...
EUVD-2026-81960
In the Linux kernel, the following vulnerability has been resolved: net/sched: account classifier filter allocations to memcg Allocations in the tc classifier change paths filter objects, per-CPU counters, and per-filter aux data use plain GFPKERNEL without GFPACCOUNT, allowing unprivileged users...