CVE-2026-63988

CVE-2026-63988 concerns a Linux kernel fix for sleeping in atomic context during sysfs path handling in bridge brport_store(). The root cause: brport_store() previously held the bridge lock for many attributes; now most attributes don’t require the lock. As a result, calling dev_set_promiscuity()...

CVE-2026-63984

CVE-2026-63984 affects the Linux kernel, addressing an overflow in the IPv6 RPL SRH decompression path. The bug occurs in ipv6_rpl_srh_decompress(): hdrlen is computed as outhdr->hdrlen = (((n + 1) * sizeof(struct in6_addr)) >> 3); since hdrlen is an 8-bit value, for n >= 127 the resu...

CVE-2026-63984 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

EUVD-2026-45757

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

EUVD-2026-45756

In the Linux kernel, the following vulnerability has been resolved: net/sched: fix packet loop on netem when duplicate is on When netem duplicates a packet it re-enqueues the copy at the root qdisc. If another netem sits in the tree the copy can be duplicated again, recursing until the stack or...

CVE-2026-63983

The CVE-2026-63983 entry concerns the Linux kernel net/sched component with netem, where duplicating a packet could cause recursive duplication loops in the qdisc tree, potentially exhausting stack or memory. Root cause: the old duplication guard invalidly zeroed q->duplicate around re-enqueue...

EUVD-2026-45755

In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix ethx:ingress - ethy:egress - ethx:ingress mirred loop When mirred redirects to ingress from either ingress or egress the loop state from schedmirreddev array dev is lost because of 1 the packet deferral into the...

CVE-2026-63981

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: Fix blockcast recursion bypass leading to stack overflow tcfmirredact checks schedmirrednest against MIRREDNESTLIMIT 4 to prevent deep recursion. However, when the action uses blockcast tcfmblockid != 0, the...

CVE-2026-63979 net/handshake: hand off the pinned file reference to accept_doit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63979

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

EUVD-2026-45751

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

EUVD-2026-45750

In the Linux kernel, the following vulnerability has been resolved: dpll: zl3073x: use dplldevicechangentf and remove changework The changework was introduced to send device change notifications from DPLL device callbacks without deadlocking on dplllock, since the callbacks are already invoked...

CVE-2026-63976 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

CVE-2026-63976 Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

EUVD-2026-45749

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: l2cap: clear chan-ident on ECRED reconfiguration success l2capecredreconfrsp returns early on success without clearing chan-ident. Every other L2CAP response handler l2capecredconnrsp, l2capleconnectrsp, l2capconfigrsp...

CVE-2026-63977

The CVE-2026-63977 entry concerns the Linux kernel dpll ( zl3073x ) subsystem. The fix replaces the change_work mechanism with the exported __dpll_device_change_ntf(), calling it directly while holding dpll_lock, and removes the change_work infrastructure. This addresses a race where change_work ...

CVE-2026-63975

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

EUVD-2026-45748

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: Fix possible crash on l2capecredconnrsp If dcid is received for an already-assigned destination CID the spec requires that both channels to be discarded, but calling l2capchandel may invalidate the tmp cursor...

CVE-2026-63975

In the Linux kernel Bluetooth L2CAP stack, CVE-2026-63975 describes a crash when a dcid arrives for an already-assigned destination CID. The fix avoids invalidating a temporary cursor from list_for_each_entry_safe and instead defers closing the channel by scheduling l2cap_chan_timeout with a dela...

CVE-2026-63974

CVE-2026-63974 affects the Linux kernel Bluetooth subsystem. The issue arises in hci_sync where HCI_CMD_DRAIN_WORKQUEUE must be set during device close because hci_dev_close_sync() can be invoked on a reset path, preventing timeouts from being queued while the hdev workqueue drains. The consequen...