CVE-2026-53012

CVE-2026-53012 affects the Linux kernel: when an IPv6 nexthop is replaced with an IPv4 nexthop, the has_v4 flag in groups containing that nexthop is not updated. The reverse direction (AF_INET6 to AF_INET) is missed, enabling a stale has_v4=false to bypass fib6_check_nexthop and may cause a NULL ...

CVE-2026-53008

In the Linux kernel, the following vulnerability has been resolved: ice: fix race condition in TX timestamp ring cleanup Fix a race condition between icefreetxtstampring and icetxmap that can cause a NULL pointer dereference. icefreetxtstampring currently clears the ICETXFLAGSTXTIME flag after...

CVE-2026-53008 ice: fix race condition in TX timestamp ring cleanup

In the Linux kernel, the following vulnerability has been resolved: ice: fix race condition in TX timestamp ring cleanup Fix a race condition between icefreetxtstampring and icetxmap that can cause a NULL pointer dereference. icefreetxtstampring currently clears the ICETXFLAGSTXTIME flag after...

CVE-2026-53007

CVE-2026-53007 affects the Linux kernel ice driver. The vulnerability arises when ice_set_ringparam() clears tstamp_ring of temporary tx_rings without clearing ICE_TX_RING_FLAGS_TXTIME. If ICE_TX_RING_FLAGS_TXTIME is set and ice_setup_tx_ring() then fails, unwinding can dereference a NULL tstamp_...

CVE-2026-53007 ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of icesetringparam icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent...

CVE-2026-53007

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of icesetringparam icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent...

CVE-2026-53007 ice: fix potential NULL pointer deref in error path of ice_set_ringparam()

In the Linux kernel, the following vulnerability has been resolved: ice: fix potential NULL pointer deref in error path of icesetringparam icesetringparam nullifies tstampring of temporary txrings, without clearing ICETXRINGFLAGSTXTIME bit. When ICETXRINGFLAGSTXTIME is set and the subsequent...

CVE-2026-52990 fsnotify: fix inode reference leak in fsnotify_recalc_mask()

In the Linux kernel, the following vulnerability has been resolved: fsnotify: fix inode reference leak in fsnotifyrecalcmask fsnotifyrecalcmask fails to handle the return value of fsnotifyrecalcmask, which may return an inode pointer that needs to be released via fsnotifydropobject when the...

CVE-2026-52990

The CVE-2026-52990 issue affects the Linux kernel fsnotify subsystem, where fsnotify_recalc_mask() can leak an inode reference if the HAS_IREF flag transitions from true to false and the returned inode pointer is not released. A race between adding and detaching marks may skip proper cleanup, cau...

CVE-2026-52933

A flaw was found in the Linux kernel's iouring/poll component. A logic error exists in the iopollgetownership function due to an incorrect signed comparison. This flaw prevents the necessary slowpath from being triggered when the IOPOLLCANCELFLAG is set, potentially leading to unexpected behavior...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: x86/mm/pat: Fixed the handling of VMPAT when fork fails in copypagerange. If trackpfncopy fails, we have already added the dst VMA to the maple tree. When fork fails, we will clean up the maple tree, and encounter issues with the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: tracing/dma: CapDMAmapsg tracepoint arrays to prevent buffer overflows. The dmamapsg tracepoint can cause a PERF buffer overflow when tracing large scatter-gather lists. When devices like virtio-gpu create large DRM buffers, the...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In md/raid10, the wait barrier is required before returning a discard request with the REQNOWAIT flag. The raid10handlediscard function should also wait for the barrier before returning a discard bio that has the REQNOWAIT flag...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix outer network offset The udpgrocomplete function assumes that all packets inserted into the receive queue have the encapsulation flag set to zero. However, this assumption is not true. Some hardware network cards ca...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Duplicate handshake cancellations cause a socket leak. When a handshake request is cancelled, it is removed from the handshakenet-hnrequests list, but it remains in the handshakerhashtbl until it is destroyed. If a...

CVE-2026-52944 ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTL_SET_SPARSE

In the Linux kernel, the following vulnerability has been resolved: ksmbd: fix FSCTL permission bypass by adding a permission check for FSCTLSETSPARSE FSCTLSETSPARSE in fsctlsetsparse modifies the file's sparse attribute and saves it through xattr without any permission checks. This exposes two...

CVE-2026-52933

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: fix signed comparison in iopollgetownership iopollgetownership uses a signed comparison to check whether pollrefs has reached the threshold for the slowpath: if unlikelyatomicread&req-pollrefs = IOPOLLREFBIAS...

CVE-2026-52933

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: fix signed comparison in iopollgetownership iopollgetownership uses a signed comparison to check whether pollrefs has reached the threshold for the slowpath: if unlikelyatomicread&req-pollrefs = IOPOLLREFBIAS...

UBUNTU-CVE-2026-52933

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: fix signed comparison in iopollgetownership iopollgetownership uses a signed comparison to check whether pollrefs has reached the threshold for the slowpath: if unlikelyatomicread&req-pollrefs = IOPOLLREFBIAS...

CVE-2026-52933

In the Linux kernel, the following vulnerability has been resolved: iouring/poll: fix signed comparison in iopollgetownership iopollgetownership uses a signed comparison to check whether pollrefs has reached the threshold for the slowpath: if unlikelyatomicread&req-;pollrefs = IOPOLLREFBIAS...