EUVD-2026-59221

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

EUVD-2026-59222

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72322 ipv6: mcast: Fix potential UAF in MLD delayed work

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72322 ipv6: mcast: Fix potential UAF in MLD delayed work

In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix potential UAF in MLD delayed work A race condition exists between device teardown and incoming MLD query processing, leading to a Use-After-Free in the MLD delayed work. During device destruction, the primary...

CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72323

CVE-2026-72323 — Linux kernel igmp UAF vulnerability : A race between device teardown (inetdev_destroy) and IGMP query processing (igmp_rcv) can cause a Use-After-Free in the IGMP timer callback when the timer is re-armed. The in_device memory is freed via RCU after its refcount reaches 0, but ig...

CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72321 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

CVE-2026-72321 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

CVE-2026-72321

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

EUVD-2026-59220

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

CVE-2026-72321

CVE-2026-72321 affects the Linux kernel’s IGMP timer handling (ipv4: igmp). The root cause is a memory leak when deleting or stopping timers in igmp_mod_timer() and igmp_stop_timer(): refcount_dec(&im->refcnt) can drop the group entry im to zero on an RC reader path, leaving the im object leak...

CVE-2026-72320 netfilter: nft_lookup: fix catchall element handling with inverted lookups

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

CVE-2026-72319

The CVE-2026-72319 entry describes a Linux kernel vulnerability in IPVS where inner IP headers in ICMP errors must be kept within skb headroom after removing outer headers (pskb_pull). The root cause involves ensuring the inner headers remain present for functions such as ipv4_update_pmtu(), icmp...

EUVD-2026-59218

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

EUVD-2026-59219

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

CVE-2026-72319 ipvs: ensure inner headers in ICMP errors are in headroom

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72320

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftlookup: fix catchall element handling with inverted lookups nftlookupeval decides whether a lookup matched found from the direct set lookup and priv-invert before falling back to the catchall element used by interva...

CVE-2026-72319 ipvs: ensure inner headers in ICMP errors are in headroom

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskbpull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom f...

CVE-2026-72320

CVE-2026-72320 concerns the Linux kernel netfilter implementation for nft_lookup. The issue arises in how inverted lookups (NFT_LOOKUP_F_INV) interact with the catchall element in interval sets, potentially causing an incorrect verdict. The documented fix folds the catchall lookup into ext before...