CVE-2026-89582

This double free vulnerability affects the bnx2x network driver in the Linux kernel . In the error path of bnx2x_init_firmware(), the pointers bp->init_ops, bp->init_data, and bp->init_ops_offsets are freed via kfree() without being set to NULL . When the cleanup function bnx2x_release_f...

CVE-2026-89582 bnx2x: fix double free in bnx2x_init_firmware() error path

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

EUVD-2026-76494

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

CVE-2026-89582 bnx2x: fix double free in bnx2x_init_firmware() error path

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

CVE-2026-89582

In the Linux kernel, the following vulnerability has been resolved: bnx2x: fix double free in bnx2xinitfirmware error path bnx2xinitfirmware frees bp-initops, bp-initdata and bp-initopsoffsets in its error path without setting them to NULL. The cleanup function bnx2xreleasefirmware frees the same...

CVE-2026-89563 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

CVE-2026-89563 ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

EUVD-2026-76474

In the Linux kernel, the following vulnerability has been resolved: ip6tunnel: use skbcowhead in ip6tnlxmit ip6tnlxmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skbreallocheadroom, copies skb-sk ownership, consumes the...

EUVD-2026-76404

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

CVE-2026-89498 affects the orangefs (PVFS2) module in the Linux kernel. On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf via vfree() when copy_from_iter_full() fails but does not clear the pointer before jumping to the error path. The waiter in do_readdir() is...

CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498 orangefs: fix double-free of trailer_buf on readdir copy failure

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-89498

In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailerbuf on readdir copy failure On a readdir downcall, orangefsdevreqwriteiter frees op-downcall.trailerbuf with vfree when copyfromiterfull fails, but does not clear the pointer before goto Efault...

CVE-2026-80989

CVE-2026-80989 affects the Linux kernel Thunderbolt networking subsystem (net: thunderbolt). When a Thunderbolt connection fails to establish, failure paths in tbnet_connected_work() fail to clear the login_sent state, leaving the connection appearing established. A subsequent tbnet_tear_down() t...

EUVD-2026-76312

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnetconnectedwork undoes its own work and returns without clearing loginsent, so the connection still looks established. The next...

CVE-2026-80989 net: thunderbolt: Mark the connection down when bringing it up fails

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnetconnectedwork undoes its own work and returns without clearing loginsent, so the connection still looks established. The next...

CVE-2026-80989

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Mark the connection down when bringing it up fails Every failure path in tbnetconnectedwork undoes its own work and returns without clearing loginsent, so the connection still looks established. The next...

CVE-2026-57842

NetBSD contains a use-after-free and double-free vulnerability in msgrecvcopyin within the COMPATNETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kern...

CVE-2026-57842

NetBSD is affected by a use-after-free and double-free vulnerability in msg_recv_copyin() within the COMPAT_NETBSD32 compatibility layer. The root cause is a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD sy...

EUVD-2026-76106

NetBSD contains a use-after-free and double-free vulnerability in msgrecvcopyin within the COMPATNETBSD32 compatibility layer due to a missing return statement before the cleanup label on the success path. Any local user able to execute a 32-bit binary on a 64-bit NetBSD system can trigger a kern...