CVE-2026-64132

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

CVE-2026-64132 ipv6: ioam: refresh hdr pointer before ioam6_event()

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

CVE-2026-64125

In Linux kernel BCMGENET, enabling Energy Efficient Ethernet (EEE) with RBUF_EEE_EN and RBUF_PM_EN breaks RX flow, causing frames to be dropped and rx_packets to stop incrementing; paging faults via bcmgenet_rx_poll have been observed on some hardware (e.g., Pi 4B with BCM2711/BCM54213PE). The is...

CVE-2026-64124 net: devmem: reject dma-buf bind with non-page-aligned size or SG length

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

EUVD-2026-45809

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

CVE-2026-64124 net: devmem: reject dma-buf bind with non-page-aligned size or SG length

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length netdevmembinddmabuf trusts dmabuf-size and sgdmalen to be PAGESIZE multiples without checking: - txvec is sized dmabuf-size / PAGESIZE, and netdevmemgetniov...

CVE-2026-64117

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...

EUVD-2026-45801

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6hopioam Reported by Sashiko: The function ipv6hopioam accesses in6devgetskb-dev-cnf.ioam6enabled without validating the returned idev pointer. Because addrconfifdown can concurrently cle...

CVE-2026-64113

In the Linux kernel, CVE-2026-64113 fixes a use-after-free in ixgbevf when pruning VEPA multicast frames. The function ixgbevf_clean_rx_irq() frees an skb (dev_kfree_skb_irq) and continues, but the skb pointer is kept outside the loop. On the next iteration, the code may dereference freed memory ...

CVE-2026-64110

Summary (CVE-2026-64110) : Several sources describe a memory-leak vulnerability in the Linux kernel igc driver (Intel Gigabit Ethernet). The root cause is that when igc_fpe_init_tx_descriptor() fails, an allocated skb is not freed, causing a potential memory exhaustion condition. The fix is to ca...

EUVD-2026-45795

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igcfpexmitsmdframe When igcfpeinittxdescriptor fails, no one takes care of an allocated skb, leaking it. 1 Use devkfreeskbany on failure. Tested on an I226 adapter with the following command, while...

CVE-2026-64101 fwctl: pds: Validate RPC input size before parsing

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

CVE-2026-64101 fwctl: pds: Validate RPC input size before parsing

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

EUVD-2026-45786

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

CVE-2026-64098

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtiogpucursorplaneupdate and virtiogpuresourceflush lock the framebuffer BO's dmaresv via virtiogpuarraylockresv and ignore its return value. The function can fail wit...

CVE-2026-64098

In the Linux kernel, the following vulnerability has been resolved: drm/virtio: use uninterruptible resv lock for plane updates virtiogpucursorplaneupdate and virtiogpuresourceflush lock the framebuffer BO's dmaresv via virtiogpuarraylockresv and ignore its return value. The function can fail wit...

EUVD-2026-45776

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

CVE-2026-64091

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...

CVE-2026-64091

CVE-2026-64091 affects batman-adv in the Linux kernel, addressing a TOCTOU race in the TT-based TVLV generation for reported VLANs. The issue arises because the buffer used to hold VLAN entries is sized based on a prefilter that may undercount or overcount VLANs during parallel updates, while the...

CVE-2026-64091 batman-adv: tt: fix TOCTOU race for reported vlans

In the Linux kernel, the following vulnerability has been resolved: batman-adv: tt: fix TOCTOU race for reported vlans The local TT based TVLV is generated by first checking the number of VLANs which have at least one TT entry. A new buffer with the correct size for the VLANs is then allocated...