CVE-2026-74667

CVE-2026-74667 is an out-of-bounds read in the Linux kernel's net/packet subsystem. The packet_parse_headers() function fails to reset skb->mac_header for protocol-bound SOCK_RAW sockets, SOCK_DGRAM frames, and the legacy SOCK_PACKET path. When these frames traverse the PACKET_QDISC_BYPASS tra...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

EUVD-2026-64354

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74665 net: fix skb length accounting after generic XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

EUVD-2026-64352

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

CVE-2026-74665

CVE-2026-74665 affects the Linux kernel 's generic XDP (eXpress Data Path) path. When an XDP program adjusts the fragment area, bpf_prog_run_generic_xdp() updates skb->data_len but leaves skb->len with the old fragment contribution. After a fragment shrink, skb_headlen() becomes larger than...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651 staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in rtwgetwpaie rtwgetwpaie reads bytes at fixed offsets into a vendor-specific information element without checking that the element is long enough, causing an out-of-bounds read for a short...

CVE-2026-74651

CVE-2026-74651 is an out-of-bounds read in the Linux kernel's rtl8723bs Wi-Fi driver (staging). The function rtw_get_wpa_ie() reads a 4-byte OUI+type and a 2-byte version word at fixed offsets into a vendor-specific information element (EID 221) without verifying the IE body is at least 6 bytes l...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74650 staging: rtl8723bs: fix OOB read in WMM_param_handler()

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

CVE-2026-74650

CVE-2026-74650 is an out-of-bounds read in the Linux kernel's staging: rtl8723bs driver. The function WMM_param_handler() copies a fixed 18-byte WMM parameter element from a received information element without validating that the element length is at least 24 bytes. Two of its three callers (OnA...

EUVD-2026-64587

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix OOB read in WMMparamhandler WMMparamhandler copies a fixed-size WMM parameter element out of a received information element without checking that the element is long enough, causing an out-of-bounds read f...

EUVD-2026-64586

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649

A missing length validation in the Linux kernel rtl8723bs staging driver's WEP shared-key authentication handler (OnAuthClient()) allows a malicious Access Point to send a malformed WLAN_EID_CHALLENGE element with a length up to 255 bytes, which is then copied via memcpy() into a fixed 128-byte c...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74649 staging: rtl8723bs: fix missing shared-key auth challenge length check

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: fix missing shared-key auth challenge length check The WEP shared-key authentication handler uses the challenge-text element's attacker-controlled length without checking it against the fixed 128-byte chgtxt...

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...