CVE-2026-74727

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

CVE-2026-74727

CVE-2026-74727 is a race condition in the Linux kernel ovpn (OpenVPN) module that leads to a Use-After-Free (UAF) . The root cause is a TOCTOU window in ovpn_nl_peer_set_doit() and ovpn_peer_endpoints_update(): a peer resolved by ID can be concurrently removed (via OVPN_CMD_PEER_DEL, keepalive ex...

CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...

CVE-2026-74662 inet: frags: publish queues before arming timer

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

PT-2026-79732

In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from by id ovpn nl peer set doit resolves the target peer via ovpn peer get by id before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequen...

PT-2026-79667

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inet frag create arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before...

CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

UBUNTU-CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74513 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74492

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

EUVD-2026-55292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferenced a freed xfAppWindow pointer during HashTableFree cleanup. This occurred because xfrailwindowcommon called freeappWindow in case of title allocation failures, without first removin...

SUSE CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

EUVD-2026-48967

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...