CVE-2026-74714

A use-after-free vulnerability in the Linux kernel BPF TCP iterator, specifically in bpf_iter_tcp_established_batch(). The root cause is a race condition: sock_hold() increments the reference count of a request_sock whose rsk_refcnt is still zero at publish time, and the subsequent refcount_set(3...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64401

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74631

CVE-2026-74631 affects the Linux kernel net: smc subsystem, specifically the smc_rx_splice() function. The root cause is a splice entry lifetime imbalance : pages are passed to splice_to_pipe() before the references covering each entry's lifetime are taken. In the VM-backed RMB path, unqueued ent...

EUVD-2026-64568

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74631 net: smc: fix splice entry lifetime imbalance in smc_rx_splice

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

CVE-2026-74630

A use-after-free vulnerability in the Linux kernel's IPv6 subsystem, specifically in in6_dev_get(). The function reads dev->ip6_ptr under RCU and unconditionally increments the refcount, but device teardown can clear the pointer and drop the last reference between these two operations, resurre...

CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

EUVD-2026-64567

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

CVE-2026-74630 ipv6: prevent in6_dev_get() from resurrecting inet6_dev

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations...

SUSE CVE-2026-72317

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

Linux Distros Unpatched Vulnerability : CVE-2026-74631

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of ea...

Linux Distros Unpatched Vulnerability : CVE-2026-74714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock,...

PT-2026-79719

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel within the bpf iter tcp established batch function. The problem occurs because the function uses sock hold while holding a bucket lock,...

PT-2026-79705

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Linux kernel within the tc new tfilter function. This occurs when two threads attempt to create filters such as a u32 filter and a flower filter in the sam...

CVE-2026-74631: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: smc: fix splice entry lifetime imbalance in smcrxsplice smcrxsplice passes pages to splicetopipe before taking the references that cover the lifetime of each splice entry. In the VM-backed RMB path, splicetopipe may drop...

PT-2026-79635

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2-rc3 Description A use-after-free issue exists in the IPv6 implementation where the in6 dev get function reads dev-ip6 ptr under RCU Read-Copy-Update and unconditionally increments its reference count. During device...

Linux Distros Unpatched Vulnerability : CVE-2026-74630

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: prevent in6devget from resurrecting inet6dev in6devget reads dev-ip6ptr under RCU and then unconditionally increments its refcount. Device teardown can...