EUVD-2026-86797

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Acquire initmm write lock on collapse to avoid UAF x86 implements page attribute modification using its Change Page Attributes CPA mechanism. This tracks properties of ranges such as cache mode through x86 page...

CVE-2026-97939 ipmr: account multicast table and route memory

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

CVE-2026-97939

The Linux kernel is affected by a vulnerability where a netadmin in a user+net namespace could create numerous IPv4 and IPv6 multicast routing tables using MRT_TABLE and MRT6_TABLE. Because these mr_table objects were not charged to memcg , the host's unreclaimable slab would grow proportionally ...

CVE-2026-97939

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

CVE-2026-97939 ipmr: account multicast table and route memory

In the Linux kernel, the following vulnerability has been resolved: ipmr: account multicast table and route memory A netadmin in a user+net namespace can create many IPv4 and IPv6 multicast routing tables with MRTTABLE and MRT6TABLE. Each unseen id allocates an mrtable via the shared mrtablealloc...

CVE-2026-97611

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

EUVD-2026-86742

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

CVE-2026-97611 net: openvswitch: fix use-after-free of the flow table mask array

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

CVE-2026-97611

The Linux kernel contains a use-after-free vulnerability in the Open vSwitch component involving the flow table mask array. The issue exists in tbl_mask_array_realloc(), where call_rcu() is invoked to retire the old mask_array before it is no longer reachable. Because the pointer swap with rcu_as...

CVE-2026-97611 net: openvswitch: fix use-after-free of the flow table mask array

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix use-after-free of the flow table mask array tblmaskarrayrealloc retires the old maskarray before it stops being reachable: old = ovsldereferencetbl-maskarray; if old ... callrcu&old-rcu, maskarrayrcucb;...

CVE-2026-97598

The Linux kernel contains a vulnerability in the ipv4: fib component where the fib_empty_table() function probes every table ID starting from 1 until a free one is found. In a dense set of IDs, this causes each probe to walk a growing hash chain while the RTNL is held. To mitigate this, the autom...

CVE-2026-97598

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97598 ipv4: fib: bound automatic table ID allocation

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

CVE-2026-97598 ipv4: fib: bound automatic table ID allocation

In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: bound automatic table ID allocation fibemptytable probes every table ID from 1 until it finds a free one. IPv4 tables are stored in a 256-bucket hash table, so a dense set of IDs makes each probe walk a growing hash...

EUVD-2026-86888

In the Linux kernel, the following vulnerability has been resolved: media: rkvdec: bound HEVC tile loops and PPS id to the array capacity computetilesuniform and computetilesnonuniform loop over numtilecolumnsminus1 + 1 / numtilerowsminus1 + 1 entries, and assemblehwpps writes one COLUMNWIDTH /...

CVE-2026-97525 x86/mm/pat: Allocate split page tables as kernel page tables

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Allocate split page tables as kernel page tables A PTE is allocated directly without going through the standard page table allocation routines such as ptealloconekernel when the CPA code splits a large page...

CVE-2026-97525

The Linux kernel contains a vulnerability where split page tables are allocated without using standard allocation routines (like pte_alloc_one_kernel()) during large page splits (__split_large_page()). This prevents the page table constructor from being called and, critically, fails to mark the p...

CVE-2026-92564

The Apache Qpid Broker-J (versions through 10.1.0 ) is vulnerable to a Denial of Service (DoS) condition via unbounded type nesting . An unauthenticated remote attacker can send specially crafted messages containing deeply nested data structures during AMQP 0-8/0-9/0-9-1 field-table processing. B...

CVE-2026-92564 Apache Qpid Broker-J: Unbounded type nesting can lead to stack overflow pre-authentication in AMQP 0-8/0-9/0-9-1 field-table processing

A pre-authentication attacker could leverage type nesting to cause a StackOverflowError potentially leading to denial of service. This issue affects Apache Qpid Broker-J: through 10.1.0. Users are recommended to upgrade to version 10.1.1, which fixes the issue...

CVE-2026-66073: Uncontrolled Resource Consumption

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, Atom table exhaustion via management API node field. pUT /api/queues/:vhost/:name and the exchanges and bindings endpoints accepts a node JSON field. The value goes through rabbitnodes:make →...