CVE-2026-64564

CVE-2026-64564 concerns a Linux kernel SCTP DEL-IP processing bug. The vulnerability arises because sctp_process_asconf() caches the ASCONF transport in asconf->transport (tied to chunk->transport) and that transport can be different from the packet source address when looked up via __sctp_...

SUSE CVE-2026-64543

In the Linux kernel, the following vulnerability has been resolved: tipc: fix use-after-free of the discoverer in tipcdiscrcv bearerdisable frees b-disc with tipcdiscdelete's plain kfree, but tipcdiscrcv still dereferences b-disc in RX softirq under rcureadlock tipcudprecv - tipcrcv - tipcdiscrcv...

CVE-2026-64248

A flaw was found in the Linux kernel, specifically affecting systems using the MIPS architecture. During the shutdown process of a CPU, the kernel's internal mechanism responsible for managing concurrent data access Read-Copy Update or RCU is not properly informed that the CPU is no longer active...

kernel: net: bridge: use a stable FDB dst snapshot in RCU readers

A flaw was found in the Linux kernel. Inconsistent handling of local Forwarding Database FDB entries in the bridge networking component's RCU Read-Copy-Update readers can lead to a null-pointer dereference. A local attacker could exploit this by triggering a concurrent update to an FDB entry,...

CVE-2026-64543

CVE-2026-64543 — Linux TIPC use-after-free fixed . The vulnerability occurs in tipc_disc_rcv() where the discoverer object is freed with kfree while still referenced under an RCU read-side critical section, allowing a local unprivileged user to crash the system via TIPCv2 genl interactions. The f...

UBUNTU-CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

LoongArch: Report dying CPU to RCU in stop_this_cpu()

...

MIPS: smp: report dying CPU to RCU in stop_this_cpu()

...

SUSE CVE-2026-64352

In the Linux kernel, the following vulnerability has been resolved: bpf: Allow LPM map access from sleepable BPF programs trielookupelem annotates its rcudereferencecheck walks with only rcureadlockbhheld. Because rcudereferencecheckp, c resolves to "c || rcureadlockheld", this passes for XDP/NAP...

SUSE CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

SUSE CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64459

In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcpaodestroysock Commit 51e547e8c89c "tcp: Free TCP-AO/TCP-MD5 info/keys without RCU" removed the callrcu callback from tcpaodestroysock, arguing that "the destruction of info/keys is delayed unti...

CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

UBUNTU-CVE-2026-64419

In the Linux kernel, the following vulnerability has been resolved: mm/shrinker: do not hold RCU lock in shrinkerdebugfscountshow Reading the debugfs "count" file of a memcg-aware shrinker can sleep inside an RCU read-side critical section: BUG: sleeping function called from invalid context at...

UBUNTU-CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

EUVD-2026-49037

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...

CVE-2026-64525 xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

In the Linux kernel, the following vulnerability has been resolved: xfrm: move policybydst RCU sync from per-netns .exit to .preexit The struct pernetoperations docstring in include/net/netnamespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking...