CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684

This vulnerability is a NULL pointer dereference in the Linux kernel's net: tap module, specifically in tap_get_user_xdp(). When the vhost TX path passes an XDP buffer containing a GSO virtio-net header with the protocol field set to zero, tun_vnet_hdr_to_skb() can reach dev_parse_header_protocol...

EUVD-2026-64371

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74684 net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp()

In the Linux kernel, the following vulnerability has been resolved: net: tap: set skb-dev before parsing virtio net header in tapgetuserxdp The commit 4f61f133f354 "net: tap: NULL pointer derefence in devparseheaderprotocol when skb-dev is null" fixed a crash in tapgetuser by assigning skb-dev...

CVE-2026-74667

CVE-2026-74667 is an out-of-bounds read in the Linux kernel's net/packet subsystem. The packet_parse_headers() function fails to reset skb->mac_header for protocol-bound SOCK_RAW sockets, SOCK_DGRAM frames, and the legacy SOCK_PACKET path. When these frames traverse the PACKET_QDISC_BYPASS tra...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

CVE-2026-74667 net/packet: reset the MAC header on the packet-socket transmit path

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

EUVD-2026-64354

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packetparseheaders resets the MAC header only for a SOCKRAW frame whose socket did not bind a protocol. A protocol-bound SOCKRAW socket, any SOCKDGRAM frame, and...

EUVD-2026-64585

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74648 staging: rtl8723bs: validate monitor transmit frame lengths

In the Linux kernel, the following vulnerability has been resolved: staging: rtl8723bs: validate monitor transmit frame lengths rtwcfg80211monitorifxmitentry removes the radiotap header and then reads the 802.11 frame control field without checking that a base 802.11 header remains. The data path...

CVE-2026-74621

CVE-2026-74621 is an unbounded memory leak in the Linux kernel's net/sched: act_ct (traffic control connection-tracking action). When tcf_ct_handle_fragments() rejects a packet via header sanity checks (returning -EINVAL, -ENOMEM, or -EPROTO), the skb remains owned by the caller, yet tcf_ct_act()...

CVE-2026-74621 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-74621 net/sched: act_ct: fix sk_buff leak when the header checks reject a packet

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

EUVD-2026-64558

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix skbuff leak when the header checks reject a packet tcfcthandlefragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTOIPV4 err =...

CVE-2026-16260

The Post Grid, Slider & Carousel Ultimate WordPress plugin, in versions prior to 1.8.1 , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The flaw exists because the plugin fails to properly sanitise and escape a custom post type setting before rendering it within an HTML attribute on...

CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

CVE-2026-16260 Post Grid, Slider & Carousel Ultimate < 1.8.1 - Contributor+ Stored XSS via Header Title Field

The Post Grid, Slider & Carousel Ultimate WordPress plugin before 1.8.1 does not sanitise and escape one of its custom post type settings before outputting it in an HTML attribute on the admin edit screen, allowing users with the Contributor role and above to inject JavaScript that executes in th...

SUSE CVE-2026-63379

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent processes chunked HTTP trailers in http.c through evhttpreadtrailer and merges them into request headers. The fix introduces evhttpparseheadersimpl and a temporary trailer header list. An unauthenticated remote...

SUSE CVE-2026-63385

Libevent is an event notification library. Prior to 2.1.13 and 2.2.2-alpha, libevent has two HTTP parsing weaknesses in http.c. evhttpdecodeuriinternal decodes percent-encoded %00 bytes into literal NUL characters, which can cause downstream C string operations to truncate a path and bypass...

SUSE CVE-2026-74866

@fastify/busboy is a multipart form-data parser for Node.js. Its multipart part-header parser splits header lines only on the two-byte carriage-return line-feed sequence, so a lone carriage return or line feed embedded in a part header is not treated as a line break and is carried verbatim into t...