CVE-2026-74267

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcodel: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever codel drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog before i...

EUVD-2026-58568

A flaw has been found in francoisjacquet RosarioSIS up to 12.8. This affects the function DBUpdate of the file Discipline/Referrals.php. This manipulation causes authorization bypass. The attack may be initiated remotely. The exploit has been published and may be used. Upgrading to version 12.9 i...

CVE-2026-68337

The CVE affects the Linux kernel BPF redirect helpers (bpf_redirect* and skb_do_redirect) and the bpf_net_context flow. The issue arose when a BPF program ran via tc BPF paths and accessed current->bpf_net_context unconditionally, leading to NULL dereferences. Specifically, redirects via tc qd...

EUVD-2026-55519

In the Linux kernel, the following vulnerability has been resolved: net/sched: serialize qdiscrtablist against concurrent get/put qdiscgetrtab and qdiscputrtab mutate the process-global singly linked list qdiscrtablist and a plain non-atomic 'int refcnt' with no lock. This was only safe because...

CVE-2026-68138

The CVE-2026-68138 issue concerns a race in the Linux kernel networking scheduler (net/sched) where qdisc_rtab_list and a non-atomic refcnt are mutated without proper locking. The historical RTNL mutex was supposed to serialize rate-table lookups, inserts, and frees, but CLS_FLOWER/TCF_PROTO_OPS_...

CVE-2026-64233

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

SUSE CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

UBUNTU-CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

EUVD-2026-48642

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: uvc: hold opts-lock across XU walks in uvcfunctionbind uvcfunctionbind walks &opts-extensionunits twice without holding opts-lock: - directly, for the iExtension string-descriptor fixup loop; - indirectly, four times...

CVE-2026-64012

A flaw was found in the Linux kernel's Stochastic Fair Blue SFB queue discipline net/sched: schsfb. This vulnerability occurs when the sfb component, acting as a parent queue, attempts to retrieve a network packet from its child queue using an incorrect dequeue function. This can lead to a null...

CVE-2026-64207

A flaw was found in the Linux kernel's DualPI2 Dual-rate PI2 queue discipline. This vulnerability arises from incorrect accounting of Generic Segmentation Offload GSO backlog, where the parent queue such as QFQ - Hierarchical Fair Queueing miscalculates the number of queued packets. This...

CVE-2026-63983

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

CVE-2026-64012

The CVE affects the Linux kernel net/sched sch_sfb path. When sch_sfb has children (e.g., qfq) whose peek() callback is qdisc_peek_dequeued(), a dequeue on the parent can cause a NULL dereference in the child’s dequeue path, potentially leading to a kernel panic. The fix replaces the direct deque...

CVE-2026-64012 net/sched: sch_sfb: Replace direct dequeue call with peek and qdisc_dequeue_peeked

In the Linux kernel, the following vulnerability has been resolved: net/sched: schsfb: Replace direct dequeue call with peek and qdiscdequeuepeeked When sfb has children eg qfq qdisc whose peek callback is qdiscpeekdequeued, we could get a kernel panic. When the parent of such qdiscs eg illustrat...

CVE-2026-63983 net/sched: fix packet loop on netem when duplicate is on

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change

In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...

The vulnerability of the ets_qdisc_change() function in the net/sched/sch_ets.c module of the network/sched/sch_ets subsystem of the Linux operating system allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the etsqdiscchange function in the net/sched/schets.c file, within the network scheduling subsystem of the Linux kernel, is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality,...

Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error

...

SUSE CVE-2026-52984

In the Linux kernel, the following vulnerability has been resolved: net/sched: netem: fix queue limit check to include reordered packets The queue limit check in netemenqueue uses q-tlen which only counts packets in the internal tfifo. Packets placed in sch-q by the reorder path qdiscenqueuehead...