kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

Linux Distros Unpatched Vulnerability : CVE-2026-72250

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and th...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

UBUNTU-CVE-2026-74368

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-74368

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-72250

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

UBUNTU-CVE-2026-72250

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

UBUNTU-CVE-2026-72057

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

CVE-2026-74368 wifi: ath12k: fix memory leak in ath12k_wifi7_dp_rx_h_verify_tkip_mic()

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

EUVD-2026-59515

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12kwifi7dprxhverifytkipmic In ath12kwifi7dprxhverifytkipmic, the call to ath12kdprxchecknwifihdrlenvalid may return false when the NWIFI header length is invalid, causing the function to abort...

CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

EUVD-2026-59149

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...

EUVD-2026-59015

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

CVE-2026-72057 net/sched: act_ct: preserve tc_skb_cb across defragmentation

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tcskbcb/qdiscskbcb control buffe...

CVE-2026-72057

In CVE-2026-72057, the Linux kernel net/sched code path act_ct is vulnerable due to tc_skb_cb not being preserved when defragmenting. The function tcf_ct_handle_fragments() calls nf_ct_handle_fragments() without saving/restoring skb->cb, and the defrag helper clears IPCB/IP6CB that alias the t...

PT-2026-72804

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix memory leak in ath12k wifi7 dp rx h verify tkip mic In ath12k wifi7 dp rx h verify tkip mic, the call to ath12k dp rx check nwifi hdr len valid may return false when the NWIFI header length is invalid, causing t...

PT-2026-72246

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: preserve tc skb cb across defragmentation tcf ct handle fragments calls nf ct handle fragments without saving and restoring skb-cb. The defrag helper clears IPCB/IP6CB, which aliases the tc skb cb/qdisc skb cb...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/sched: Only allow actct to bind to clsact/ingress qdiscs and shared blocks. As Paolo mentioned earlier 1: “Since the problematic commit below, classify can return TCACTCONSUMED while holding the current skb that is managed by...

CentOS 9 : kernel-5.14.0-731.el9

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the kernel-5.14.0-731.el9 build changelog. - In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...