kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option CIPSO IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 IC...

kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nftinner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset innerthoff becomes desynchronized from the Layer 4 protocol l4proto. A remot...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

kernel: rxrpc: Fix RxGK token loading to check bounds

A flaw was found in the Linux kernel's rxrpc subsystem. An unprivileged local user could exploit an integer overflow vulnerability in the rxrpcpreparsexdryfsrxgk function. This flaw occurs when processing specially crafted key and ticket lengths, causing an incorrect memory allocation size...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-74562

A flaw was found in the Linux kernel's nexthop component. A race condition exists where internal lists are walked without proper locking during nexthop replacement and route deletion. A local attacker could exploit this by concurrently manipulating IPv6 routes, leading to a use-after-free...

CVE-2026-74549

A flaw was found in the hwmon hardware monitoring driver for the nct6775-core in the Linux kernel. During initialization, the driver incorrectly accesses memory beyond the allocated buffer when handling certain register arrays. This out-of-bounds read can lead to the use of invalid hardware...

CVE-2026-74528

A flaw was found in the Linux kernel's Bluetooth subsystem. This vulnerability, a use-after-free, occurs when the hcisync component improperly handles connection references, leading to the potential reuse and access of freed memory pointers. A remote attacker could exploit this to cause system...

CVE-2026-74500

A flaw was found in the Linux kernel's ALSA Advanced Linux Sound Architecture USB audio driver, specifically affecting RME Digiface devices. An unprivileged local user could exploit this vulnerability by reading the device status, which, due to an uninitialized buffer, may expose sensitive kernel...

CVE-2026-74456

A flaw was found in the Linux kernel's Controller Area Network CAN Universal Serial Bus USB driver. This vulnerability, a double free, occurs when a USB request block URB submission fails, causing the system to attempt to release the same memory twice. This could allow a local attacker to...

CVE-2026-74445

A flaw was found in the Linux kernel's drm/vmwgfx component. A local attacker can trigger a null pointer dereference by sending a specially crafted command to the vmwcmddxbindquery function. This can lead to a kernel crash, resulting in a Denial of Service DoS for the affected system...

CVE-2026-72445

A flaw was found in the Linux kernel's ALSA USB audio driver for QCOM devices. An attacker, by providing an invalid service interval during stream enablement, can cause the audio substream to become unresponsive. This can lead to a Denial of Service DoS for the affected audio device, requiring a...

CVE-2026-72088

A flaw was found in the Linux kernel's hpsa SCSI driver. When a physical disk is in a reset state, the driver fails to properly unmap Direct Memory Access DMA resources. This oversight can lead to a DMA mapping leak, potentially causing resource exhaustion over time...

CVE-2026-72069

A flaw was found in the Linux kernel. The rtspinunlock function, and similar real-time RT locking mechanisms, incorrectly release Read-Copy-Update RCU protection before fully unlocking, leading to a Use-After-Free UAF vulnerability. This issue could allow a local attacker to potentially cause a...

CVE-2026-74506

A flaw was found in the Linux kernel's AFS Andrew File System component. A race condition exists in the afsmakecall function during asynchronous call reception and destruction when sending a message. This can lead to a Use-After-Free UAF vulnerability, where memory is improperly accessed after it...

CVE-2026-74491

A flaw was found in the Linux kernel. A null pointer dereference vulnerability exists within the ofpcirangeparserone function. This occurs when ofmatchbus returns a null value for nodes with specific range properties, which is then improperly dereferenced. An attacker could potentially exploit th...

CVE-2026-74471

A flaw was found in the Linux kernel's tracing subsystem. The tracemoduleaddevents function does not properly check the return value of registerevent. If event registration fails, a pointer to an event can still be created and retained even after the associated module memory is freed. This can le...

CVE-2026-72458

A flaw was found in the Linux kernel's Apparmor security module. This vulnerability occurs in the unpackpdb function, where it does not correctly handle a null pointer if a preceding operation, unpackdfa, fails. This oversight can lead to a NULL pointer dereference, which typically results in a...

CVE-2026-72373

A flaw was found in the AFS Andrew File System component of the Linux kernel. A missing NULL pointer check in the afsbreaksomecallbacks function could allow a local attacker to trigger a kernel panic, leading to a denial of service. This occurs when the afslookupvolumercu function returns a NULL...

CVE-2026-74578

A flaw was found in the Linux kernel's algifskcipher cryptographic module. An unprivileged local user could exploit a race condition in the asynchronous I/O AIO path, where a concurrent operation overwrites the Initialization Vector IV used by an in-flight cryptographic request. This IV reuse...