24659 matches found
CVE-2026-74715 bpf: Fix netns reference imbalance in conntrack kfuncs
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
EUVD-2026-64402
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpfnfctlookup and bpfnfctallocentry read opts-netnsid separately when acquiring and releasing t...
CVE-2026-74715
This vulnerability affects the Linux kernel BPF conntrack kfuncs (__bpf_nf_ct_lookup() and __bpf_nf_ct_alloc_entry()). The root cause is a race condition : the opts->netns_id field is read separately when acquiring and releasing the network namespace reference. Because opts can point to a shar...
EUVD-2026-64382
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...
CVE-2026-74695
This vulnerability affects the Linux kernel netfilter flowtable offload path (nf_flow_table). When incoming skbs pass through flowtable offload hooks or the XFRM offload path, they may already carry a ref-counted dst_entry from earlier RX or routing steps. Calling skb_dst_set_noref() in this stat...
CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...
EUVD-2026-64379
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74675 vt: stabilize tty reference in kbd_keycode with tty_port_tty_get
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbdkeycode with ttyportttyget kbdkeycode reads vc-port.tty without acquiring a tty reference, racing against conshutdown which clears port.tty under a different lock. Use ttyportttyget/ttykrefput to...
CVE-2026-74675
CVE-2026-74675 is a race condition in the Linux kernel virtual terminal (VT) subsystem. The function kbd_keycode() reads vc->port.tty without acquiring a tty reference, while con_shutdown() can clear port.tty under a different lock, creating a window where a dangling pointer may be dereference...
EUVD-2026-64362
In the Linux kernel, the following vulnerability has been resolved: vt: stabilize tty reference in kbdkeycode with ttyportttyget kbdkeycode reads vc-port.tty without acquiring a tty reference, racing against conshutdown which clears port.tty under a different lock. Use ttyportttyget/ttykrefput to...
EUVD-2026-64349
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...
CVE-2026-74662 inet: frags: publish queues before arming timer
In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...
EUVD-2026-64347
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebtnflog: pin the NFLOG backend nflogunregister runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebtnflog passes an explicit UL...
EUVD-2026-64581
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damonpamigrate and damosvamigrate isolate folios into a local list and then call damonmigratepages. When targetnid is invalid including the scheme default NUMANONODE / -1...
CVE-2026-74644 mm/damon/ops-common: putback folios on invalid migrate nid
In the Linux kernel, the following vulnerability has been resolved: mm/damon/ops-common: putback folios on invalid migrate nid damonpamigrate and damosvamigrate isolate folios into a local list and then call damonmigratepages. When targetnid is invalid including the scheme default NUMANONODE / -1...
EUVD-2026-64565
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...
CVE-2026-74628
This is a use-after-free vulnerability in the Linux kernel's net/x25 subsystem. The X.25 timers are armed with mod_timer() and cancelled with timer_delete(), which means a pending timer holds no reference to the socket. Because x25_heartbeat_expiry() rearms the timer unconditionally, it can reins...
CVE-2026-74628 net/x25: fix use-after-free of the socket by its timers
In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free of the socket by its timers The x25 timers are armed with modtimer and cancelled with timerdelete, so a pending timer holds no reference on the socket and a cancel does not wait for a callback already...
CVE-2026-74586 sctp: clear new_transport when removing a peer
In the Linux kernel, the following vulnerability has been resolved: sctp: clear newtransport when removing a peer sctpprocessasconfparam stores a newly added peer transport in asoc-newtransport. After all parameters in the ASCONF chunk have been processed, sctpsfdoasconf uses this pointer to send...
