Linux Distros Unpatched Vulnerability : CVE-2026-90225

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt read llcpsock-local before locksocksk and then dereferenced the cached...

AZL-102590 CVE-2026-90157 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90327 phonet: pep: do not write beyond optlen in getsockopt

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

CVE-2026-90327 phonet: pep: do not write beyond optlen in getsockopt

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

CVE-2026-90226

CVE-2026-90226 affects the Linux kernel NFC LLCP subsystem . In nfc_llcp_getsockopt(), the kernel unconditionally stores 4 bytes via put_user() regardless of the caller-supplied optlen, because the existing min_t(u32, len, sizeof(u32)) only clamps the reported length but not the actual write. A c...

EUVD-2026-81819

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

CVE-2026-90225 nfc: llcp: read llcp_sock->local under the socket lock in getsockopt

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: read llcpsock-local under the socket lock in getsockopt nfcllcpgetsockopt read llcpsock-local before locksocksk and then dereferenced the cached pointer inside the locked region. llcpsockbind assigns and clears...

CVE-2026-90157

CVE-2026-90157 affects the Linux kernel BPF cgroup getsockopt hook. A cgroup getsockopt BPF program can shrink ctx->optlen after the kernel getsockopt handler runs. The kernel-buffer variant (used by TCP_ZEROCOPY_RECEIVE ) only rejects values larger than the original length, so a negative optl...

CVE-2026-90157 bpf: Reject negative optlen in cgroup getsockopt hook

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

EUVD-2026-81750

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

CVE-2026-90093 Bluetooth: L2CAP: access chan->conn safely in get/setsockopt

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: access chan-conn safely in get/setsockopt Since commit b66774b48dd9 "Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref" l2capchan::conn has held reference and remains non-NULL also after the...

PT-2026-94573

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC LLCP module. The function nfc llcp getsockopt reads the llcp sock-local pointer before acquiring the socket lock via lock socksk. Simultaneously, llcp...

PT-2026-94675

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the pep getsockopt function where the system fails to properly bound the amount of data written to the user buffer. While the function uses min t to clamp the reported...

CVE-2026-90327: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: phonet: pep: do not write beyond optlen in getsockopt pepgetsockopt clamps the reported length to the caller's buffer with mint, but then stores the value with putuserval, int user optval, which always writes sizeofint bytes. A...

CVE-2026-90226: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: avoid userspace overflow on invalid optlen nfcllcpgetsockopt casts optval to u32 user for putuser, so the kernel always stores 4 bytes regardless of the caller-supplied optlen. The existing mintu32, len, sizeofu32 only...

PT-2026-94574

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the nfc llcp getsockopt function where the kernel always stores 4 bytes when using put user, regardless of the optlen provided by the caller. Because the existing leng...

PT-2026-94505

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cgroup getsockopt BPF program where the ctx-optlen can be shrunk after the kernel getsockopt handler has executed. In the kernel-buffer variant used by TCP ZEROCOP...

CVE-2026-90157: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject negative optlen in cgroup getsockopt hook A cgroup getsockopt BPF program can shrink ctx-optlen after the kernel getsockopt handler has run. The kernel-buffer variant, used by TCPZEROCOPYRECEIVE, only rejects values...

PT-2026-94441

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the Bluetooth L2CAP implementation where l2cap chan::conn retains a reference and remains non-NULL even after the associated hci conn is deleted. Accessing fields such...

Astra Linux – Vulnerability in Linux, Linux 5.10

A use-after-free read flaw was discovered in the sockgetsockopt function in net/core/sock.c, due to race conditions involving SOPEERCRED and SOPEERGROUPS functions when used with listen and connect in the Linux kernel. In this flaw, an attacker with user privileges could potentially crash the...