CVE-2026-64581

In the Linux kernel, the following vulnerability has been resolved: x...

CVE-2026-64581

CVE-2026-64581: Linux kernel XFRM double-free in xfrm_user_policy() due to non-atomic sk_dst_cache updates. A per-socket policy change can race with UDP transmit path, causing both sides to release the same dst and freeing the xfrm_dst bundle twice. The fix uses an atomic sk_dst_reset() with a si...

CVE-2026-64570

In CVE-2026-64570, Linux kernel wifi/mac80211 fixes a double-free in FILS discovery: ieee80211_set_fils_discovery() frees the old template with kfree_rcu() before allocating the replacement. If kzalloc() fails (ENOMEM), link->u.ap.fils_discovery still points to the old object, and a later AP t...

EUVD-2026-53262

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix unsolbcastproberesp double free on alloc failure ieee80211setunsolbcastproberesp calls kfreercu on the old template before allocating the replacement. If the kzalloc then fails, it returns -ENOMEM while...

CVE-2026-64568

CVE-2026-64568 affects the Linux kernel’s mac80211/wifi stack. The vulnerability arises in ieee80211_set_unsol_bcast_probe_resp(): it frees the old unsol_bcast_probe_resp template with kfree_rcu() before a replacement has been allocated. If kzalloc() fails, link->u.ap.unsol_bcast_probe_resp st...

CVE-2026-64568

In the Linux kernel, the following vulnerability has been resolved: w...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

CVE-2026-64386

A flaw was found in the Linux kernel's Server Message Block SMB client. This vulnerability, a double-free error, occurs when the queryinfo replay mechanism attempts to free a response buffer that has already been released. This can happen if an error occurs during the initialization of an SMB2...

kernel security update

An update is available for kernel. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

RLSA-2026:49212 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 kernel: tipc: fix double-free in tipcbufappend CVE-2026-52993 kernel: net: sched: UAF via missing handler for TCACTCONSUM...

RockyLinux 9 : kernel (RLSA-2026:49212)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49212 advisory. kernel: ipc: limit nextid allocation to the valid ID range CVE-2026-52923 kernel: tipc: fix double-free in tipcbufappend CVE-2026-52993 kernel: net:...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: tipc: fix double-free in tipc_buf_append()

A flaw was found in the Linux kernel's Transparent Inter-Process Communication TIPC module. This vulnerability, a double-free, occurs when the tipcbufappend function incorrectly handles memory after a socket buffer skb reallocation. An attacker could potentially exploit this to cause system...

kernel: xen/privcmd: fix double free via VMA splitting

A flaw was found in the Linux kernel's xen/privcmd module. A local user could exploit this by performing a partial unmapping of a privcmd memory region. This action causes a Virtual Memory Area VMA to split, leading to duplicated internal memory pointers. As a result, the same memory can be freed...

openssh security update

8.0p1-30.0.1 - Update upstream references Orabug: 36587718 8.0p1-30 - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-185775 - CVE-2026-55655: Fix MITM of X11 forwarding via abstract UNIX...

Oracle Linux 8 : kernel (ELSA-2026-45115)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-45115 advisory. - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level Aidan Wallace RHEL-213341 CVE-2026-63807 - KVM: x86: Don't recheck L1...

Redis < 8.8.0 RCE via RESTORE Double Free (CVE-2026-66373)

The version of Redis installed on the remote host is prior to 8.8.0. It is, therefore, affected by a remote code execution vulnerability. - Redis before 8.8.0, in the unusual case where an authenticated attacker can execute RESTORE, allows remote code execution via a RESTORE payload where the sam...

openssh security update

An update is available for openssh. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list OpenSSH is an SSH protocol implementation supported by a number of Linux, UNI...

RLSA-2026:47756 Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fixes: openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Rocky Linux...