CVE-2026-90072

CVE-2026-90072 is a signed overflow vulnerability in the Linux kernel's net/sched: sfq (Stochastic Fairness Queuing) qdisc. In sfq_init(), the quantum value is set from psched_mtu(), which returns an unsigned value. A device with an extremely large MTU (e.g., a dummy device with max_mtu == 0 acce...

CVE-2026-90072 net/sched: sfq: clamp quantum to avoid signed overflow soft lockup

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfqinit sets q-quantum = pschedmtuqdiscdevsch unsigned. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return...

EUVD-2026-81933

In the Linux kernel, the following vulnerability has been resolved: net/sched: sfq: clamp quantum to avoid signed overflow soft lockup sfqinit sets q-quantum = pschedmtuqdiscdevsch unsigned. A device with a huge MTU e.g. dummy with maxmtu == 0 accepting MTU 2147483634 makes pschedmtu return...

EUVD-2026-81919

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

CVE-2026-90058 net/sched: bound qdisc_pkt_len to prevent qdisc soft lockup

In the Linux kernel, the following vulnerability has been resolved: net/sched: bound qdiscpktlen to prevent qdisc soft lockup qdiscgetstab accepts a user-supplied size table, and qdisccalculatepktlen amplifies qdiscpktlen through the overhead, the size-table data u16, and sizelog up to...

CVE-2026-90058

CVE-2026-90058 is a Linux kernel vulnerability in the net/sched subsystem. The root cause is that qdisc_get_stab() accepts a user-supplied size table, and __qdisc_calculate_pkt_len() amplifies qdisc_pkt_len() through overhead, size-table data (u16), and size_log, allowing a crafted stab to set th...

CVE-2026-90053

CVE-2026-90053 is a vulnerability in the Linux kernel 's HTB qdisc (net/sched: sch_htb). The function htb_classify() follows filter-selected inner classes without bounding the traversal depth, so a self-referencing or cyclic inner-class u32 filter creates an infinite loop in the packet classifica...

EUVD-2026-81914

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

CVE-2026-90053 net/sched: sch_htb: limit htb_classify inner-class filter hops

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhtb: limit htbclassify inner-class filter hops htbclassify follows each filter-selected inner class by switching to cl-filterlist, but never bounds the number of hops. A filter on an inner class can point back to...

cve-2020-0022

cve-2020-0022 poc para cve-2020-0022 uso gcc poc.c -lbluetooth -o poc poc MACADDR información Este poc debería ser estable en android 8.1.0, una vez que entra en el truncamiento de paquetes, se bloquea. Pero puede ser muy inestable, en Samsung s9 plus seguramente inestable. Ejecutar poc en...

CVE-2026-89968

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

AZL-101280 CVE-2026-89903 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

AZL-101568 CVE-2026-89906 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...

DEBIAN-CVE-2026-89903

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

CVE-2026-89903

In the Linux kernel, the following vulnerability has been resolved: LoongArch: Do not save/restore percpu base register in rethook trampoline The rethook trampoline saves $r21 $u0, the percpu base, into its frame at entry and restores it at exit. Inbetween rethooktrampolinehandler may schedule vi...

EUVD-2026-80568

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

CVE-2026-89968

CVE-2026-89968 affects the Linux kernel's NVMe/TCP target (nvmet-tcp). The function nvmet_tcp_handle_h2c_data_pdu() accepts an H2CData PDU without verifying that the target has actually solicited the data via an R2T for that command. A remote host can exploit this by sending an H2CData PDU before...

CVE-2026-89968 nvmet-tcp: reject unsolicited H2CData PDUs

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

CVE-2026-89968 nvmet-tcp: reject unsolicited H2CData PDUs

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: reject unsolicited H2CData PDUs nvmettcphandleh2cdatapdu accepts an H2CData PDU after only checking that its TTAG is a valid in-range command index and that the command's data buffers are mapped. It never checks that t...

EUVD-2026-80506

In the Linux kernel, the following vulnerability has been resolved: LoongArch: BPF: Refactor jump offset calculation in tail call The old macro-based jmpoffset calculation derives the jump distance from a stale prior-pass code stride, which can lead to wrong branch offsets and soft lockups under...