CVE-2026-68398 ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

CVE-2026-11368

The Bluetooth host ATT layer subsys/bluetooth/host/att.c associates each in-flight ATT TX buffer with its owning channel via the static txmetadatastorage array data-attchan = chan. When a buffer's last reference is dropped, its net-buf destroy callback defers the completion handling to the system...

CVE-2026-11368

Summary of CVE-2026-11368 details: The Bluetooth host ATT layer (att.c) ties in-flight ATT TX buffers to channels via tx_meta_data_storage[]. When a buffer is freed, completion handling defers to a workqueue path (att_tx_destroy -> att_tx_destroy_work_handler -> att_on_sent_cb -> bt_att_...

CVE-2026-64122 net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover mlx5etxreportertimeoutrecover accesses sq-netdev after mlx5esafereopenchannels has torn down and freed the channel and its embedded SQs. Replace the three sq-netdev...

CVE-2026-64122

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover mlx5etxreportertimeoutrecover accesses sq-netdev after mlx5esafereopenchannels has torn down and freed the channel and its embedded SQs. Replace the three sq-netdev...

CVE-2026-64122

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover mlx5etxreportertimeoutrecover accesses sq-netdev after mlx5esafereopenchannels has torn down and freed the channel and its embedded SQs. Replace the three sq-netdev...

CVE-2026-64122 net/mlx5e: Fix use-after-free in mlx5e_tx_reporter_timeout_recover

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix use-after-free in mlx5etxreportertimeoutrecover mlx5etxreportertimeoutrecover accesses sq-netdev after mlx5esafereopenchannels has torn down and freed the channel and its embedded SQs. Replace the three sq-netdev...

CVE-2026-10654

A race condition in the Zephyr Bluetooth Classic RFCOMM host stack subsys/bluetooth/host/classic/rfcomm.c mishandles a simultaneous bidirectional session disconnect. When the local device has initiated a session teardown state BTRFCOMMSTATEDISCONNECTING, DISC sent, RTX timer armed and the connect...

CVE-2026-10654

The CVE-2026-10654 issue is a race in Zephyr’s Bluetooth Classic RFCOMM host stack (subsys/bluetooth/host/classic/rfcomm.c): when one side initiates a session teardown and the peer simultaneously sends a DISC for DLCI 0, rfcomm_handle_disc() forces the session to DISCONNECTED without calling bt_l...

DEBIAN-CVE-2026-31638

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Only put the call ref if one was acquired rxrpcinputpacketonconn can process a to-client packet after the current client call on the channel has already been torn down. In that case chan-call is NULL, rxrpctrygetcall retur...

CVE-2026-23454

In the Linux kernel, the following vulnerability has been resolved: net: mana: fix use-after-free in manahwcdestroychannel by reordering teardown A potential race condition exists in manahwcdestroychannel where hwc-callerctx is freed before the HWC's Completion Queue CQ and Event Queue EQ are...

DEBIAN-CVE-2025-23151

In the Linux kernel, the following vulnerability has been resolved: bus: mhi: host: Fix race between unprepare and queuebuf A client driver may use mhiunpreparefromtransfer to quiesce incoming data during the client driver's tear down. The client driver might also be processing data at the same...

PT-2025-18405

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between mhi unprepare from transfer and mhi queue buf functions. When a client driver uses mhi unprepare from transfer to quiesce incoming data during its teardow...