CVE-2026-74611

A flaw was found in the Linux kernel's Transport Layer Security TLS 1.3 implementation. When processing TLS 1.3 records with optimistic zero-copy enabled, the tlsdecryptsg function fails to properly restore the message iterator during a retry. A remote attacker, by sending a specially crafted TLS...

CVE-2026-70634

A flaw was found in TimescaleDB. An out-of-bounds read vulnerability exists in the Dictionary compression reverse row iterator. Attackers with Data Manipulation Language DML access to a physical compressed database table can store specially crafted data. By performing a reverse-order scan, this...

Astra Linux – Vulnerability in Linux 5.10

In the Linux kernel, the following vulnerability has been resolved: bpf: Exclusive maps for bpfmapelem iterators are rejected Exclusive maps also known as exclproghash are meant to be accessible only from the single program whose hash matches that map. This rule is enforced by...

SUSE CVE-2026-74611

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

SUSE CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

AZL-97064 CVE-2026-74714 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

UBUNTU-CVE-2026-74714

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714

A use-after-free vulnerability in the Linux kernel BPF TCP iterator, specifically in bpf_iter_tcp_established_batch(). The root cause is a race condition: sock_hold() increments the reference count of a request_sock whose rsk_refcnt is still zero at publish time, and the subsequent refcount_set(3...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

EUVD-2026-64401

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74714 bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch()

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock, and only afterwards sets rskrefcnt to 3. Lockless readers such as...

CVE-2026-74611

CVE-2026-74611 affects the Linux kernel TLS 1.3 receive path. When optimistic zero-copy is enabled via TLS_RX_EXPECT_NO_PAD, tls_decrypt_sg() advances msg->msg_iter to map user pages. If the decrypted record is not unpadded application data (e.g., a TLS 1.3 control record), tls_decrypt_sw() re...

CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry

In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...

Linux Distros Unpatched Vulnerability : CVE-2026-74714

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: tcp: Fix use-after-free in bpfitertcpestablishedbatch reqskqueuehashreq publishes a TCPNEWSYNRECV requestsock onto the ehash chain, drops the bucket lock,...

Linux Distros Unpatched Vulnerability : CVE-2026-74611

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If...

PT-2026-79719

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Linux kernel within the bpf iter tcp established batch function. The problem occurs because the function uses sock hold while holding a bucket lock,...

PT-2026-79616

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the TLS receive path where tls decrypt sg advances the msg-msg iter when mapping user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record is not...

Linux Distros Unpatched Vulnerability : CVE-2026-74360

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Reject exclusive maps for bpfmapelem iterators Exclusive maps aka exclproghash are meant to be reachable only from the single program whose hash matches...