ovswrap

OVSwrap — Linux kernel Open vSwitch datapath overflow tracking site Source for the OVSwrap patch-status tracker: a single-page site recording which distributions have shipped a fix for the Open vSwitch datapath overflow in the Linux kernel. Where the facts live Everything about the bug — CVE IDs,...

TUNderflow

TUNderflow CVE-2026-81000 Writeup !WARNING 本 PoC 仅用于帮助防御者、维护者和经授权的安全团队，在他们拥有或明确获授权测试的系统上验证补丁、缓解措施、检测规则和暴露面。 您需自行负责确保对本材料的使用是合法、经授权、受控的，并在隔离的测试环境中进行。 !WARNING 本 PoC 具有破坏性。 它会修改 /etc/pam.d/su，且没有任何回滚机制。 一次位置错误的覆写可能会破坏无关的内核内存，导致机器挂起或崩溃。 仅在一次性 VM/可丢弃主机上运行。 该 PoC： 1. 进入私有的用户/网络命名空间，创建 TUN 设备以及...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: pagepool: Always add GFPNOWARN for ATOMIC allocations. Driver authors often forget to include GFPNOWARN when allocating pages from the data path. This is annoying for users, as OOM errors are a common occurrence. We expect networ...

Astra Linux – Vulnerability in OpenVSwitch

A flaw was discovered in OpenVSwitch OVS. When processing an IP packet with protocol 0, OVS will install a datapath flow without modifying the IP header. This issue results in the installation of a datapath flow that matches all IP protocols with “nwproto” set to wildcard, but with an incorrect...

Astra Linux – Vulnerability in Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: openvswitch: Fixed a memory leak that occurred during failed datapath creation. ovsdpcmdnew - ovsdpchange - ovsdpsetupcallportids allocates an array using kmalloc. If newvport fails during ovsdpcmdnew, dp-upcallportids must be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: OpenVSwitch: fixed the issue where locking occurred when trying to unregister a netdev with a carrier. The commit in the “fixes” tag attempted to fix this issue through the following sequence of calls: dooutput → ovsvportsend →...

Linux Distros Unpatched Vulnerability : CVE-2026-72072

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst...

CVE-2026-74325

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

UBUNTU-CVE-2026-72046

In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...

CVE-2026-74325 wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

EUVD-2026-59472

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

CVE-2026-74325 wifi: mt76: use kfree_rcu for offchannel link in mt76_put_vif_phy_link

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfreercu for offchannel link in mt76putvifphylink mt76putvifphylink frees the offchannel mlink with plain kfree after rcuassignpointerNULL. However, rcuassignpointer only prevents future RCU readers from obtaining...

CVE-2026-72326 net/sched: cake: reject overhead values that underflow length

In the Linux kernel, the following vulnerability has been resolved: net/sched: cake: reject overhead values that underflow length CAKE accepts signed overhead values and stores them in an s16, but the adjusted packet length calculation uses unsigned arithmetic. A negative effective length can...

CVE-2026-72072 net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: macsec: fix use-after-free of metadatadst on RX SC delete When an offloaded MACsec RX SC is deleted, macsecdelrxscctx freed the per-SC metadatadst with metadatadstfree, which kfrees the object unconditionally and ignor...

EUVD-2026-59004

In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...

PT-2026-72261

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the net/mlx5e macsec component. When an offloaded MACsec RX SC is deleted, the macsec del rxsc ctx function frees the metadata dst object unconditionally...

PT-2026-72761

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: use kfree rcu for offchannel link in mt76 put vif phy link mt76 put vif phy link frees the offchannel mlink with plain kfree after rcu assign pointerNULL. However, rcu assign pointer only prevents future RCU readers...

New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch

A memory corruption flaw in the Linux kernel's Open vSwitch datapath gives ordinary local users a path to root on a broad set of default-configured distributions, and a public exploit ships with pre-built records for roughly 800 kernel builds. The vulnerability, tracked asCVE-2026-64531CVSS score...

PT-2026-61590

Name of the Vulnerable Software and Affected Versions Linux Fast Datapath for RHEL 9 affected versions not specified Description A security issue exists in Linux Fast Datapath for RHEL 9. Further details regarding the security impact are available in the vendor advisory. Recommendations At the...

CVE-2026-53080

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of "old" filters before change Like pointed out by Sashiko 1, since commit ed76f5edccc9 "net: sched: protect filterchain list with filterchainlock mutex" TC filters are added to a shared blo...