CVE-2026-72157

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding framecount tbnetpoll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

CVE-2026-72228

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: fix primaryif leak on failed linearization If the skb has a fraglist, it must be linearized before it can be split using skbsplit. But when this step failed, it must not only free the skb but also take care of t...

CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

CVE-2026-72235

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-72250

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

CVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved: xfrm: natkeepalive: avoid double free on send error natkeepalivesend frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once...

CVE-2026-72251

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...

UBUNTU-CVE-2026-72234

In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicastttvn skb-data only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

UBUNTU-CVE-2026-72235

In the Linux kernel, the following vulnerability has been resolved: batman-adv: retrieve ethhdr after potential skb realloc on RX pskbmaypull in batadvinterfacerx could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-72234

In the Linux kernel, the following vulnerability has been resolved: batman-adv: access unicastttvn skb-data only after skb realloc The pskbmaypull called by batadvgetvid could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-72233

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb realloc The pskbmaypull called by batadvblaisbackbonegw could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-72230

In the Linux kernel, the following vulnerability has been resolved: batman-adv: frag: free unfragmentable packet The caller of batadvfragsendpacket assume that the skb provided to the function are always consumed. But the pre-check for an empty payload or the zero fragment size returned an error...

UBUNTU-CVE-2026-72017

In the Linux kernel, the following vulnerability has been resolved: net: macb: drop in-flight Tx SKBs on close The MACB driver has since forever leaked the outgoing SKBs that have not yet been marked as completed. They live in queue-txskb which gets freed without remorse nor checking...

CVE-2026-68476

In the Linux kernel, the following vulnerability has been resolved: ipvs: reload ip header after head reallocation ipvsgetoutrt calls skbensurewritable which may reallocate skb-head...

CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74336

CVE-2026-74336 concerns the Linux kernel’s wifi/mac80211 code. The vulnerability arises in ieee80211_s1g_check_tim() when parsing the S1G TIM PVB, where the end boundary used for walking encoded blocks was incorrectly computed as tim_len + 2, allowing a read past the TIM element into adjacent dat...

CVE-2026-74324

Summary: CVE-2026-74324 affects Linux kernel wireless stack, specifically mt76/mt7925 testmode query handling. In mt7925_tm_query(), the response skb is copied with memcpy(evt_resp, skb->data + 8, MT7925_EVT_RSP_LEN) without validating length. MT7925_EVT_RSP_LEN is 512, so a firmware response ...

CVE-2026-74324 wifi: mt76: mt7925: validate skb length in testmode query

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: validate skb length in testmode query In mt7925tmquery, the response skb from mt76mcusendandgetmsg is used in a memcpy without validating its length: memcpyevtresp, skb-data + 8, MT7925EVTRSPLEN; where...

CVE-2026-74310 vhost/net: complete zerocopy ubufs only once

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubufinfo per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb referenc...