UBUNTU-CVE-2026-89664

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

UBUNTU-CVE-2026-89487

In the Linux kernel, the following vulnerability has been resolved: openvswitch: only skbtxerror a packet we are about to drop queueuserspacepacket borrows the packet skb -- it only copies it into a private netlink message userskb and does not own it; on return doexecuteactions keeps forwarding i...

UBUNTU-CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-89664 nfsd: release OPEN-decoded posix ACLs via op_release

In the Linux kernel, the following vulnerability has been resolved: nfsd: release OPEN-decoded posix ACLs via oprelease nfsd4decodecreatehow4 calls nfsd4decodefattr4, which allocates refcounted struct posixacl objects via posixaclalloc and stores them in open-oppacl and open-opdpacl. These pointe...

EUVD-2026-76394

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-89488

In the Linux kernel, the following vulnerability has been resolved: openvswitch: Fix CT limit teardown use-after-free Packet processing uses CT limit state under RCU, while netns teardown frees that state under ovsmutex. The CT limit pointer was neither removed from readers nor protected by a gra...

CVE-2026-80994

CVE-2026-80994 is a use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) datapath . During flow deletion (CMD_DEL), the flow mask is freed via RCU after removal from the flow table, but ovs_flow_cmd_fill_info() subsequently dereferences the flow->mask pointer without effective...

EUVD-2026-76317

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

CVE-2026-80994 net: openvswitch: fix flow mask use-after-free on flow deletion

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

CVE-2026-80994 net: openvswitch: fix flow mask use-after-free on flow deletion

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

CVE-2026-80994

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix flow mask use-after-free on flow deletion The commit in the Fixes tag below made so flow-mask free is scheduled via RCU right after it is removed from the flow table. The pointer stays in the flow structure...

EUVD-2026-76300

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80977

CVE-2026-80977 affects the Linux kernel networking subsystem , specifically the skb_tx_error() function in the skbuff layer. When a cloned socket buffer is processed, skb_tx_error() prematurely clears shared zerocopy state (SKBFL_ALL_ZEROCOPY) and drops SKBFL_SHARED_FRAG while the original skb is...

CVE-2026-80977

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80977 net: skbuff: don't touch shared zerocopy state in skb_tx_error()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

EUVD-2026-76245

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...

CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...

CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...

CVE-2026-81913

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to an Open Redirect via the rcURL parameter . An attacker can craft a link on the site's own domain that redirects a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft . The same ...

CVE-2026-81913 Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter.

Concrete CMS versions 9.5.0 through 9.5.2 are vulnerable to Open Redirect via the rcURL parameter. An attacker can craft a single link on the site's own domain that sends a user to an arbitrary external site immediately after authentication, facilitating phishing and credential theft. The same...