CVE-2026-98800

In the Linux kernel, the following vulnerability has been resolved: b...

CVE-2026-98800

The Linux kernel contains a vulnerability where programs linked to a trampoline can be freed prematurely when detached. Specifically, on a preemptible kernel , a task preempted in the trampoline just before the enter helper may call the program after it has been freed, leading to a vmalloc-out-of...

Vulnerability-Disclosure-Policy

Vulnerability Disclosure Policy We believe that vulnerability disclosure is a two-way street. Vendors, as well as researchers, must participate in co-ordinated vulnerability disclosure. When Enable Security discovers vulnerabilities through its own research, it will notify vendors of these...

CVE-2026-98432

In the Linux kernel, the following vulnerability has been resolved: ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copying it. Another cpu can concurrently process a retransmitted SYN for th...

CVE-2026-98432

ipv4: free inetopt and ireqopt after an RCU grace period...

cve-2026-52910-poc

CVE-2026-52910 — reuseport cBPF use-after-free reproducer A race reproducer and stress toolkit for CVE-2026-52910 , a use-after-free UAF in the Linux kernel's handling of classic BPF cBPF reuseport selector programs , fixed upstream by commit "bpf: Free reuseport cBPF prog after RCU grace period"...

CVE-2026-22009-Linux-eBPF-Map-Locking-Race-Use-After-Free

CVE-2026-22009 – Linux eBPF Map Locking Race → Use‑After‑Free Program Code C simulation // ebpfmapuaf.c - Simulated concurrent map update/free include include include include void mapdata = NULL; int mapfreed = 0; void updatemapvoid arg // Simulate eBPF program updating map if !mapfreed char...

Linux Distros Unpatched Vulnerability : CVE-2026-98320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: flowtable: hold reference on ct until flow is released nfctput releases the ct-ext area inmediately, the rcu typesafe semantics also allow to refer t...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Fixed a UAF Use-after-Allocation issue by correcting mismatching between the bpfprog/attachment and tasks-trace-RCU flavors. Uprobes always use bpfprogrunarrayuprobe under tasks-trace-RCU protection. However, it is possible ...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: bpf: Fixed a race condition between bpftimercancelandfree and bpftimercancel. This race condition could lead to a UAF Use-After-Free error involving the timer-timer variable. Here’s the detailed explanation: In bpftimer...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: Unconditionally increments set-nelems before inserting an element. In the event that the set is full, a new element is inserted and then removed without waiting for the RCU grace period. Meanwhile, the RCU...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables – Release flowtable after the rcu grace period with an error. The function synchronizercu is called after unregistering the hooks from the error path. This is because a hook that already references this...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: mctp: Route lookups now perform under a RCU read-side lock. Our current route lookups mctproutelookup and mctproutelookupnull traverse the network’s route list without holding the RCU read lock. This means that the route lookups...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftct: Fixed a use-after-free in the destroy function for timeout objects. The nftcttimeoutobjDestroy function frees the timeout object using kfree, immediately after nfcttimeoutout, without waiting for an RCU grace...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: bpf: The reuseport cBPF prog is freed after the RCU grace period. Eulgyu Kim reported the issue below with a reproduction example. The reproduction example sets up a UDP reuseport group with a cBPF prog and replaces it with a new...

SUSE CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...

CVE-2026-98026

The Linux kernel contains a vulnerability in the net: bridge: mcast component where the br_multicast_del_port_group function unlists a port group without using the proper RCU helper to preserve the next pointer. Consequently, the port group is freed immediately without waiting for the RCU grace p...

AZL-103958 CVE-2026-93288 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...

CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...

UBUNTU-CVE-2026-93288

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlinklog: wait for rcu grace period before freeing pernet state sashiko reports: "nfnllognetexit calls nflogunset, which clears the logger pointer without an RCU grace period. Immediately after, opsfreelist frees t...