EUVD-2026-55275

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix union collision of module and refcnt for dynamic events In 'struct traceeventcall', the 'module' pointer and the 'refcnt' atomic variable share the same memory space in a union. For dynamic events, the union member i...

CVE-2026-68170 mptcp: fix stale skb->sk reference on subflow close

In the Linux kernel, the following vulnerability has been resolved: mptcp: fix stale skb-sk reference on subflow close The backlog list is updated by mptcpdataready under mptcpdatalock. The cleanup of backlog references to a closing subflow, however, was performed in mptcpclosessk, before...

CVE-2026-68170

CVE-2026-68170, affecting Linux kernel MPTCP, describes a use-after-free risk caused by a stale backlog backlog entry referencing a closing subflow. The issue arises because backlog cleanup was performed in mptcp_close_ssk() without holding the ssk lock or mptcp_data_lock(), while concurrent RX p...

CVE-2026-68138

The CVE-2026-68138 issue concerns a race in the Linux kernel networking scheduler (net/sched) where qdisc_rtab_list and a non-atomic refcnt are mutated without proper locking. The historical RTNL mutex was supposed to serialize rate-table lookups, inserts, and frees, but CLS_FLOWER/TCF_PROTO_OPS_...

CVE-2026-68126

The CVE-2026-68126 vulnerability affects the Linux kernel mac802154 path by dereferencing the scanned sub-interface (sdata->dev) after the RCU read unlock and after the rtnl is dropped, leading to a use-after-free when DEL_INTERFACE or PHY removal unregisters the interface. The root cause is t...

CVE-2026-68122 ovpn: fix peer refcount leak in TCP error paths

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

EUVD-2026-55503

In the Linux kernel, the following vulnerability has been resolved: ovpn: fix peer refcount leak in TCP error paths When either the TCP RX or TX error path calls ovpnpeerhold followed by schedulework&peer-tcp.deferdelwork, and the work item is already pending from the other path, schedulework...

CVE-2026-68122

CVE-2026-68122: Linux kernel ovpn code has a race in TCP error paths where ovpn_peer_hold() refs can be leaked if schedule_work() is already pending. The fix is to check schedule_work() return value on both RX/TX error paths and drop the extra reference with ovpn_peer_put() when the work is alrea...

CVE-2026-68095

The CVE-2026-68095 entry affects Linux kernel fuse-uring, describing a race between registration and connection abortion that could leak the ring, queue, and ent if not properly synchronized. The concrete fix is to check fch->connected under fch->lock after the created ent has grabbed a ref...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: slimbus: core: fix device reference leak on report present Slimbus devices can be allocated dynamically upon receiving report-present messages. Be sure to release the reference taken when checking for already registered devices...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ext4: fixed the iloc.bh leak in ext4xattr inodeupdateref The error branch of ext4xattr inodeupdateref forgot to release the refcount for iloc.bh. This issue was discovered during code review...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: PCI/P2PDMA: Release the per-CPU pgmap reference when vminsertpage fails. When vminsertpage fails in p2pmemallocmmap, p2pmemallocmmap does not invoke percpurefput to free the per-CPU reference to pgmap acquired after...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: RDMA/rxe: Fixed a race condition in QP timer handlers I encountered the following warning: WARNING: drivers/infiniband/sw/rxe/rxetask.c:249 at rxeschedtask+0x1c8/0x238 rdmarxe, CPU0: swapper/0/0 … libsha1 last unloaded:...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumrouter: Fix neighbor use-after-free We sometimes encounter situations where a use-after-free occurs when dereferencing a neighbor pointer. The issue seems to arise because the driver stores a pointer to the neighbo...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a UAF issue in bpftrampolinelinkcgroupshim. The root cause of this bug is that when bpflinkput reduces the refcount of shimlink-link.link to zero, the resource is considered released, but it may still be referenced via...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: dmaengine: idxd: Remove the improper idxdfree The call to idxdfree introduces a duplicate putdevice call, leading to a reference count underflow: refcountt: underflow; use-after-free. WARNING: CPU: 15, PID: 4428, at...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: AppArmor: Fixed a race condition related to the dereference of rawdata objects. There is a race condition that leads to a “use-after-free” situation: Since the rawdata inodes are not counted for their references, an attacker can...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: - For the media module, in the mtk-mdp component, error handling in the probe function has been fixed. - The function mtkmdpunregisterm2mdevice has been added to the error handling path to prevent resource leaks. - A check for...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: media: mtk-mdp: A reference leak bug was fixed in mtkmdpremove. In mtkmdpprobe, vpugetplatdevice increases the reference count of the returned platform device. Add platformdeviceput to prevent the reference leak...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Net: Ethernet: mtkethsoc: Reset the progptr to oldprog in case of an error in mtkxdpsetup. Reset the eBPF program pointer to oldprog, and do not decrease its reference count if the mtkopen routine in mtkxdpsetup fails...