UBUNTU-CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74513 dibs: fix use-after-free of dmb_node in loopback attach/detach/unregister

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74513

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-74492

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

EUVD-2026-55292

In the Linux kernel, the following vulnerability has been resolved: wifi: ath12k: fix NULL pointer dereference in rhash table destroy When unbinding the ath12k driver, kernel NULL pointer dereferences occur in irqworksync called from rhashtabledestroy. Two hash tables are affected: 1. ath12klinks...

Astra Linux – Vulnerability in freerdp3

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, railwindowfree dereferenced a freed xfAppWindow pointer during HashTableFree cleanup. This occurred because xfrailwindowcommon called freeappWindow in case of title allocation failures, without first removin...

SUSE CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

EUVD-2026-48967

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423 ipv4: igmp: remove multicast group from hash table on device destruction

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: remove multicast group from hash table on device destruction When a device is destroyed under RTNL, ipmcdestroydev iterates through the multicast list and calls ipmaput on each membership, scheduling them for RCU...

CVE-2026-64423

CVE-2026-64423 affects the Linux kernel IPv4 IGMP multicast handling. The root cause is that, when a device is destroyed, ip_mc_destroy_dev() decrements the multicast membership refcount but fails to unlink the membership from the device’s multicast hash table (mc_hash) before RCUs reclaim the ob...

SUSE CVE-2026-64005

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INITHLISTHEAD&smcvhashinfo.ht are called after smcnlinit, protoregister and sockregister. This can lead to smcvhashinfo.ht being reset even though hash entries already exist and are...

CVE-2026-64005 net/smc: Do not re-initialize smc hashtables

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INITHLISTHEAD&smcvhashinfo.ht are called after smcnlinit, protoregister and sockregister. This can lead to smcvhashinfo.ht being reset even though hash entries already exist and are...

USN-8520-1: Expat vulnerability

It was discovered that Expat used insufficient entropy when generating hash salt values for its internal hash table. An attacker could use this to craft an XML document that triggers hash flooding, leading to a denial of service...

kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()

A flaw was found in the Linux kernel. A race condition exists in the TCP Transmission Control Protocol IPv6 Internet Protocol version 6 socket handling, specifically within the tcpv6synrecvsock function. This occurs because a child socket becomes visible in the TCP hash table before its...

kernel: tcp: fix potential race in tcp_v6_syn_recv_sock()

A flaw was found in the Linux kernel. A race condition exists in the TCP Transmission Control Protocol IPv6 Internet Protocol version 6 socket handling, specifically within the tcpv6synrecvsock function. This occurs because a child socket becomes visible in the TCP hash table before its...

kernel: mptcp: fix slab-use-after-free in __inet_lookup_established

A flaw was found in the Linux kernel's Multipath TCP MPTCP implementation. Due to incorrect memory allocation for IPv6 subflow child sockets, a use-after-free vulnerability exists. A remote attacker could exploit this by triggering concurrent lookups in the kernel's hash table, potentially leadin...