377403 matches found
EUVD-2026-64549
In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...
CVE-2026-74612 veth: fix skb length accounting after XDP frag adjustment
In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...
CVE-2026-74612
CVE-2026-74612 is a CRITICAL (CVSS 10.0) flaw in the Linux kernel's veth component. When an XDP program shrinks the fragment area, veth_xdp_rcv_skb() fails to update skb->len, causing skb_headlen() to exceed the actual linear area. In the UDP receive path, __skb_datagram_iter() then copies 102...
CVE-2026-74612
In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...
CVE-2026-74611
CVE-2026-74611 affects the Linux kernel TLS 1.3 receive path. When optimistic zero-copy is enabled via TLS_RX_EXPECT_NO_PAD, tls_decrypt_sg() advances msg->msg_iter to map user pages. If the decrypted record is not unpadded application data (e.g., a TLS 1.3 control record), tls_decrypt_sw() re...
CVE-2026-74611
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...
CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...
EUVD-2026-64548
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...
CVE-2026-74611 tls: rx: restore msg_iter before TLS 1.3 optimistic retry
In the Linux kernel, the following vulnerability has been resolved: tls: rx: restore msgiter before TLS 1.3 optimistic retry tlsdecryptsg advances msg-msgiter when it maps user pages for the optimistic TLS 1.3 zero-copy path. If the decrypted record turns out not to be unpadded application data,...
EUVD-2026-64547
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...
CVE-2026-74609 tipc: read le->link under the node lock in tipc_node_link_down()
In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...
CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...
CVE-2026-74609
CVE-2026-74609 is a use-after-free race condition in the Linux kernel's TIPC (Transparent Inter-Process Communication) subsystem, specifically in tipc_node_link_down(). The function caches the le->link pointer before acquiring n->lock, then dereferences it under the lock. A concurrent delet...
CVE-2026-74610
CVE-2026-74610 is a kernel NULL pointer dereference in the Linux kernel's TLS ULP (Upper Layer Protocol) implementation. The root cause is in tls_sw_sendmsg_locked(): when the copy path fills the plaintext sk_msg ring, the full_record flag is not set, leaving the record unpushed. A subsequent spl...
CVE-2026-74610
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...
CVE-2026-74609 tipc: read le->link under the node lock in tipc_node_link_down()
In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...
EUVD-2026-64546
In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...
CVE-2026-74609
In the Linux kernel, the following vulnerability has been resolved: tipc: read le-link under the node lock in tipcnodelinkdown tipcnodelinkdown caches the link pointer before taking n-lock: struct tipclink l = le-link; / unlocked / if !l return; tipcnodewritelockn; if !tipclinkisestablishingl /...
CVE-2026-74610 tls: don't leave a full plaintext sk_msg ring unpushed
In the Linux kernel, the following vulnerability has been resolved: tls: don't leave a full plaintext skmsg ring unpushed When the copy path in tlsswsendmsglocked adds the fragment that fills the plaintext skmsg ring, it does not set fullrecord, so the record is left full and unpushed. A later...
EUVD-2026-64545
In the Linux kernel, the following vulnerability has been resolved: smb: client: Fix use-after-free in cifstryaddingchannels cifstryaddingchannels takes a temporary reference to an interface before dropping ifacelock. If cifssesaddchannel fails, it drops that reference and then increments...