CVE-2026-72046

The CVE-2026-72046 issue in the Linux kernel concerns the gve RX path, where header buffers were indexed by buffer-queue position (bufq->tail) for posts and by the completion index (desc_idx) for reads. With HW-GRO and multi-flow traffic, out-of-order completions cause headers to be read from ...

EUVD-2026-59004

In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor headerbufaddr at post time and reads the split header back at completion time. Both the post and the read...

PT-2026-72235

In the Linux kernel, the following vulnerability has been resolved: gve: fix header buffer corruption with header-split and HW-GRO The DQO RX datapath programs a per-buffer-queue-descriptor header buf addr at post time and reads the split header back at completion time. Both the post and the read...

PT-2026-72842

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlan gro prepare receive. udp tunnel sock release could set sk-sk user data to NULL while vxlan gro prepare receive is running. Let's check if rcu dereference sk user data is NULL after skb...

PT-2026-72595

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in geneve gro complete Even with both paths gated on gs-gro hint, geneve gro complete re-derives the inner dispatch type and length from the packet and the current gs-gro hint, independently ...

CVE-2026-68136

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. An attacker could exploit this by sending specially crafted network packets that cause a double aggregation of flush-marked socket buffers skbs. This issue arises from a missing flush check, which allows...

AZL-94919 CVE-2026-68136 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

UBUNTU-CVE-2026-68136

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

CVE-2026-68136

CVE-2026-68136 is a Linux kernel GRO flaw where missing NAPI_GRO_CB(skb)->flush validation in skb_gro_receive_list() allows double aggregation of flush-marked skbs, potentially corrupting frag_list and leading to a kernel panic during skb_segment() (DoS). Public reports (NVD, Red Hat, Debian, ...

CVE-2026-68136 net: gro: fix double aggregation of flush-marked skbs

In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...

Astra Linux – Vulnerability found in Linux 6.12, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: net: Fixed a memory leak in skbSegmentList for GRO packets When skbSegmentList is called during packet forwarding, it handles packets that were aggregated by the GRO engine. Historically, the segmentation logic in skbSegmentList...

Linux Distros Unpatched Vulnerability : CVE-2026-68136

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 net-gro: Fix GRO flush when receiving a GSO packet. added a flush check to...

AlmaLinux 10 : kernel (ALSA-2026:44270)

The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:44270 advisory. kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs CVE-2026-46323 Tenable has extracted the preceding description block...

kernel: Linux kernel: Use-After-Free in net/gro due to improper handling of zerocopy skbs

A flaw was found in the Linux kernel's Generic Receive Offload GRO networking subsystem. This vulnerability occurs when skbgroreceive attempts to merge zerocopy socket buffers skbs without properly managing page reference counts, specifically when the SKBFLMANAGEDFRAGREFS flag is set. An attacker...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 10 : kernel (RHSA-2026:44270)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:44270 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: Linux kernel: Use-After-Free in net/g...

CVE-2026-64056 net: ethernet: cortina: Make RX SKB per-port

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-64056

The CVE covers a Linux kernel issue in the Cortina ethernet driver. The RX socket buffer (SKB) used to assemble fragments in gmac_rx() was a static local variable, which could race on devices with two ethernet ports (Gemini) when both ports are active. The fix makes the RX SKB a per-port variable...

CVE-2026-64055

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmacrx NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmacrx, but the packet is not y...