CVE-2026-74627

CVE-2026-74627 affects the Linux kernel's net: devmem component. The root cause is improper mixing of net_iov and page-backed fragments within a single skb in the zerocopy_fill_skb_from_devmem() function, which causes a crash downstream in the stack. Red Hat classifies the impact as Denial of Ser...

CVE-2026-74620

This Linux kernel vulnerability affects the net/sched subsystem, specifically the act_gact and act_police traffic control actions. The fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) bypass the range check in tcf_action_check_ctrlact(), allowing user space to store TC_ACT_C...

EUVD-2026-64549

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74612 veth: fix skb length accounting after XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74612 veth: fix skb length accounting after XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74612

CVE-2026-74612 is a CRITICAL (CVSS 10.0) flaw in the Linux kernel's veth component. When an XDP program shrinks the fragment area, veth_xdp_rcv_skb() fails to update skb->len, causing skb_headlen() to exceed the actual linear area. In the UDP receive path, __skb_datagram_iter() then copies 102...

PT-2026-79700

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf flow table: drop existing skb dst before skb dst set noref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dst entry assigned during earlier RX ...

Linux Distros Unpatched Vulnerability : CVE-2026-74627

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: devmem: prevent net-iov / page mixing We should either have netiov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow...

Linux Distros Unpatched Vulnerability : CVE-2026-74612

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area,...

PT-2026-79710

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skb udp tunnel segment gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb-head, the saved UDP header pointer is no longer...

PT-2026-79621

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb shared info tailroom xdpf clone clones broadcast copies into a single page and sets frame sz to PAGE SIZE. xdp build skb from frame later treats that page like a normal XDP frame and expects th...

PT-2026-79626

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix sk buff leak when the header checks reject a packet tcf ct handle fragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTO IPV4 err = tcf ct ipv4 i...

PT-2026-79602

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ip6 tunnel component where the ip6ip6 err function clones an outer IPv6 ICMP error skb and pulls it to the quoted inner IPv6 packet before passing the clone to...

Linux Distros Unpatched Vulnerability : CVE-2026-74665

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the...

PT-2026-79670

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp buff. If an XDP program adjusts the fragment area, bpf prog run generic xdp copies xdp frags size back t...

PT-2026-79632

In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have net iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy fill skb from devmem...

PT-2026-79672

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet parse headers resets the MAC header only for a SOCK RAW frame whose socket did not bind a protocol. A protocol-bound SOCK RAW socket, any SOCK DGRAM frame...

PT-2026-79683

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179 178a: fix skb leak in ax88179 tx fixup When the interface has NETIF F SG enabled and skb linearize fails in ax88179 tx fixup, the function returns NULL without freeing the skb. usbnet start xmit treats a NULL...

PT-2026-79706

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key extract When a packet arrives on an ARPHRD NONE device e.g. TUN, ovs flow key extract trusts the user-provided skb-protocol field: if it is ETH P TEB, the packet is classified ...

PT-2026-79669

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovs flow cmd new preallocates the optional reply skb before it takes ovs mutex and before it knows which existing flow will be updated. That is normally fine because...