CVE-2026-63857 net: airoha: Do not read uninitialized fragment address in airoha_dev_xmit()

In the Linux kernel, the following vulnerability has been resolved: net: airoha: Do not read uninitialized fragment address in airohadevxmit The transmit loop in airohadevxmit reads fragment address and length during its final iteration, when the loop index equals skbshinfoskb-nrfrags, at which...

CVE-2026-63830

In the Linux kernel, the following vulnerability has been resolved: net: skmsg: preserve sg.copy across SG transforms The skmsg sg.copy bitmap is part of the scatterlist entry ownership state. A set bit tells skmsgcomputedatapointers not to expose the entry through writable BPF ctx-data. This...

CVE-2026-63835

CVE-2026-63835 concerns the Linux kernel’s batman-adv OGM aggregation on disabled hard interfaces. When an interface is disabled, batadv_hardif_disable_interface() disables the worker and frees the skb aggr_list; however batadv_v_ogm_send_meshif() may still queue new skbs via batadv_v_ogm_queue_o...

CVE-2026-63835 batman-adv: v: prevent OGM aggregation on disabled hardif

In the Linux kernel, the following vulnerability has been resolved: batman-adv: v: prevent OGM aggregation on disabled hardif When an interface gets disabled, the worker is correctly disabled by batadvhardifdisableinterface - ... - batadvvogmifacedisable. In this process, the skb aggrlist is also...

EUVD-2026-45487

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failures

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

CVE-2026-63821

In the Linux kernel, the wifi driver stack for rtw88/USB fixed memory leaks when USB write submissions fail. Specifically, rtw_usb_write_port() failures in rtw_usb_write_data() and rtw_usb_tx_agg_skb() could leave allocated skbs and a txcb/aggregated skbs unfreed due to a missing completion callb...

PT-2026-61243

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf msg push data function within the sockmap component of the BPF Berkeley Packet Filter subsystem. When data is inserted into the middle of a scatterlist entry,...

PT-2026-61263

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth ISO implementation. The iso recv frame function reads the conn-sk pointer while holding the iso conn lock but releases the lock before...

PT-2026-61494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistent lock state exists in the networking receive path when handling PEP pipes. When an inbound socket buffer skb targets an existing PEP pipe, the pep do rcv function forwards...

PT-2026-61307

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel paging request crash occurs in the can rx unregister function within net/can/af can.c when a virtual CAN device vxcan is enslaved to a bonding master. This happens because the...

PT-2026-61262

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where iso sock close calls iso sock clear timer before acquiring the socket lock. This allows iso sock clear timer to read the...

PT-2026-61300

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A packet loop occurs in the netem Network Emulator module when the duplicate feature is enabled. When netem duplicates a packet, it re-enqueues the copy at the root qdisc Queueing...

PT-2026-61362

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ovpn tcp close function. The function loads the ovpn socket using rcu dereference sk user data under an RCU read lock, caches the peer pointer, and then...

PT-2026-61426

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the af unix module. The unix stream data wait function calls skb peek tail on the sk-sk receive queue without holding a lock to prevent Socket Buffer...

PT-2026-61328

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Logical Link Control Protocol LLCP component of the NFC subsystem. The llcp sock release function unconditionally unlinks the socket from the local...

PT-2026-61144

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in AppArmor where the sendmsg and sendto functions, when used with the MSG FASTOPEN flag, combine the actions of connect2 and write2 to open a connection during the SYN...

Linux Distros Unpatched Vulnerability : CVE-2026-63831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform...

PT-2026-61264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the Bluetooth HIDP component. The hidp input report function processes keyboard and mouse payload data from an skb socket buffer without verifying if...

PT-2026-61288

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the sctp wait for connect function and the peeloff process. The sctp wait for connect function releases and subsequently re-acquires the socket lock while...