CVE-2026-72235

A flaw was found in the Linux kernel batman-adv component. The batadvinterfacerx function, responsible for handling network packets, can reallocate its internal buffer. However, a pointer to the ethernet header is not correctly updated after this reallocation. This oversight leads to a...

CVE-2026-72233

A flaw was found in the batman-adv component of the Linux kernel. This vulnerability occurs when a buffer is reallocated, but existing pointers are not updated, leading to a use-after-free condition. A local attacker could potentially exploit this to cause a system crash denial of service or, in...

UBUNTU-CVE-2026-72233

In the Linux kernel, the following vulnerability has been resolved: batman-adv: bla: reacquire gw address after skb realloc The pskbmaypull called by batadvblaisbackbonegw could reallocate the buffer behind the skb. Variables which were pointing to the old buffer need to be reassigned to avoid an...

CVE-2026-68143

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

UBUNTU-CVE-2026-68143

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68143

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68143

CVE-2026-68143 affects the Linux kernel SLIP path. A race between MTU changes and receive processing can occur because sl_realloc_bufs() updates rbuff and buffsize while holding sl->lock, but slip_receive_buf() may write to rbuff without the lock. An MTU change/shrink can expose the new smalle...

EUVD-2026-55526

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68143 net: slip: serialize receive against buffer reallocation

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

Astra Linux – Vulnerability in expat

In libexpat before version 2.7.4, the doContent function does not properly determine the buffer size bufSize, as there is no check for integer overflow during the reallocation of the tag buffer...

Linux Distros Unpatched Vulnerability : CVE-2026-68143

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those...

JLSEC-2026-957 ImageMagick Has Signed Integer Overflow in SIXEL Decoder, Leading to Memory Corruption

A signed integer overflow vulnerability in ImageMagick's SIXEL decoder allows an attacker to trigger memory corruption and denial of service when processing a maliciously crafted SIXEL image file. The vulnerability occurs during buffer reallocation operations where pointer arithmetic using signed...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

SUSE CVE-2026-64132

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

Linux Distros Unpatched Vulnerability : CVE-2026-64132

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the...

CVE-2026-52993

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipcbufappend tipcmsgvalidate can potentially reallocate the skb it is validating, freeing the old one. In tipcbufappend, it was being called with a pointer to a local variable which was a copy of the...

CVE-2026-52993

Summary (CVE-2026-52993): In the Linux kernel TIPC module, a double-free flaw occurs in tipc_buf_append() when tipc_msg_validate() reallocates an skb and the code incorrectly frees the original skb. The root cause is that the validation path may free a previously freed skb if reallocation occurs,...

CVE-2026-52993 tipc: fix double-free in tipc_buf_append()

In the Linux kernel, the following vulnerability has been resolved: tipc: fix double-free in tipcbufappend tipcmsgvalidate can potentially reallocate the skb it is validating, freeing the old one. In tipcbufappend, it was being called with a pointer to a local variable which was a copy of the...

CVE-2026-12706

A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decodemove function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by...