EUVD-2026-49603

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-64548

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: reject overflowing copy + len in bpfmsgpushdata When the scatterlist ring is full or nearly full, bpfmsgpushdata enters a copy fallback path and computes copy + len for the page allocation size. Since len comes from...

CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-64541 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-64541

The CVE-2026-64541 issue affects the Linux kernel SMC-R stack (net/smc) and is caused by a UAF in smc_cdc_rx_handler() when the socket is freed while a connection is still discoverable. The description states that smc_cdc_rx_handler() looks up the connection by token under conns_lock, releases th...

EUVD-2026-49592

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-64541 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-48145 Apache Thrift: C++ TSSLSocket matchName() RFC 6125 Wildcard Bypass

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue...

CVE-2026-64459

A flaw was found in the Linux kernel's TCP-AO TCP Authentication Option implementation. An unprivileged local user can exploit a use-after-free vulnerability in the tcpaodestroysock function. By manipulating TCP sockets with TCPMD5SIG and TCPAOADDKEY, an attacker can trigger a race condition duri...

PT-2026-65216

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc cdc rx handler by pinning the socket smc cdc rx handler looks up the connection by token under the link group's conns lock, drops the lock, and then dereferences conn and the smc sock derived from it, endi...

CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

PT-2026-65227

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive big receive big bounds the device-announced length by big packets num skbfrags + 1 PAGE SIZE. That is still too loose: add recvbuf big sets sg1 to start at offset sizeofstruct padded vnet hdr...

Siemens SIMATIC S7-1500 CPU 1518 MFP NULL Pointer Dereference (CVE-2025-23143)

"In the Linux kernel, the following vulnerability has been resolved: net: Fix null-ptr-deref by socklockinitclassandname and rmmod. When I ran the repro 0 and waited a few seconds, I observed two LOCKDEP splats: a warning immediately followed by a null-ptr-deref. 1 Reproduction Steps: 1 Mount CIF...

UBUNTU-CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

PT-2026-65224

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: bpa10x: avoid OOB read of revision string in bpa10x setup bpa10x setup sends the vendor command 0xfc0e and passes the response to bt dev info and hci set fw info as a "%s" string starting at skb-data + 1, without...

CVE-2026-64530 net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

SUSE CVE-2026-64435

In the Linux kernel, the following vulnerability has been resolved: audit: Fix data races of skbqueuelen readers on auditqueue Multiple readers access auditqueue.qlen via skbqueuelen without holding the queue lock or using READONCE, while kauditd writes to this field via the skbdequeue - skbunlin...

SUSE CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshakenlacceptdoit needs the file pointer backing req-hrsk-sksocket to survive the window between handshakereqnext and the subsequent FDPREPARE and getfile. The...

CVE-2026-64459

In the Linux kernel, the following vulnerability has been resolved: tcp: restore RCU grace period in tcpaodestroysock Commit 51e547e8c89c "tcp: Free TCP-AO/TCP-MD5 info/keys without RCU" removed the callrcu callback from tcpaodestroysock, arguing that "the destruction of info/keys is delayed unti...