PT-2026-72622

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component where the garbage collection gc process may not shut down properly. This occurs because cancel delayed work sync is called during the...

PT-2026-72623

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component where the kfree rcu function was called before the rcu assign pointer function when handling the comment extension. This incorrect...

Linux Distros Unpatched Vulnerability : CVE-2026-72436

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: Don't use testbit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using testbit which is a...

CVE-2026-74492: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

Linux Distros Unpatched Vulnerability : CVE-2026-74492

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During...

CVE-2026-72436: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: Don't use testbit in lockless RCU readers in hash types Sashiko pointed out that there are a few lockless RCU readers using testbit which is a relaxed atomic operation and provides no memory barrier guarantees...

Linux Distros Unpatched Vulnerability : CVE-2026-72434

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork...

CVE-2026-72435: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix order of kfreercu and rcuassignpointer Sashiko pointed out that kfreercu was called before rcuassignpointer in handling the comment extension. Fix the order so that rcuassignpointer called first...

PT-2026-72944

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter ipset component where mtype resize copies comment pointers using memcpy instead of copying the actual comment objects. This creates a race condition duri...

PT-2026-72624

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description In the netfilter ipset component, lockless RCU Read-Copy-Update readers in hash types incorrectly use the test bit function. Because test bit is a relaxed atomic operation, it does not...

CVE-2026-72434: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: make sure gc is properly stopped Sashiko noticed that when destroying a set, canceldelayedworksync was called while gc calls queuedelayedwork unconditionally which can lead not to properly shutting down the gc...

netfilter: ipset: fix race between dump and ip_set_list resize

...

SUSE CVE-2026-64189

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

CVE-2026-64189

A flaw was found in the Linux kernel's netfilter ipset component. A race condition exists between the ipsetlist resize operation and dump operations. This can lead to a use-after-free vulnerability, where memory is accessed after it has been deallocated. A successful exploitation of this flaw cou...

AZL-92868 CVE-2026-64189 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

CVE-2026-64189

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

CVE-2026-64189 netfilter: ipset: fix race between dump and ip_set_list resize

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

EUVD-2026-46009

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

CVE-2026-64189

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...

CVE-2026-64189

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix race between dump and ipsetlist resize The release path of ipsetdumpdo and ipsetdumpdone read inst-ipsetlist via ipsetrefnetlink, a plain rcudereferenceraw of the array pointer. These run from netlinkrecvmsg...