CVE-2026-23437

CVE-2026-23437 (Linux kernel) concerns the net: shaper module. A missing liveness check occurs when a netdev is looked up during prep of Netlink operations, a reference is taken, and later the code uses the netdev’s lock or RCU protections. The conversion from a ref to a locked netdev may proceed...

CVE-2026-23436

The CVE-2026-23436 issue affects the Linux kernel's net: shaper component. A race could occur when a netdev is unregistered between taking a reference during Netlink prep and locking/RCU in the callback, potentially leaking the hierarchy after a flush. The fix applies the instance lock in pre- st...

PT-2026-30132

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a flaw where late read accesses to the network device hierarchy were not properly protected. A missing liveness check during the conversion from a reference to...

PT-2026-30153

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained an issue within the ip tunnel module where the iptunnel xmit stats function incorrectly assumed tunnels only used NETDEV PCPU STAT TSTATS. This occurred becaus...

PT-2026-30131

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contained a flaw where a network device could be unregistered between the time a reference was taken and the time it was locked, potentially leading to a memory leak...

The vulnerability of the mlx5_lag_add_netdev() function in the drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c driver for Mellanox Ethernet network adapters in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the mlx5lagaddnetdev function in the drivers/net/ethernet/mellanox/mlx5/core/lag/lag.c file of the Mellanox Ethernet network adapter driver in the Linux operating system is related to pointer manipulation. Exploiting this vulnerability could allow a remote attacker to cause a...

CVE-2026-23437: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: shaper: protect late read accesses to the hierarchy We look up a netdev during prep of Netlink ops pre- callbacks and take a ref to it. Then later in the body of the callback we take its lock or RCU which are the actual...

Important: kernel

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: pagepool: Fix use-after-free in pagepoolrecycleinring CVE-2025-38129 In the Linux kernel, the following vulnerability has been resolved: drm/vmwgfx: Fix a null-ptr access in the cursor snooper CVE-2025-40110 In th...

SUSE CVE-2026-23368

In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy ledtriggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDSTRIGGERNETDEV and LEDTRIGGERPHY are enabled: 1362.049207 ledtriggerregister+0x5c/0x1fc...

EUVD-2026-15351

In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy ledtriggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDSTRIGGERNETDEV and LEDTRIGGERPHY are enabled: 1362.049207 ledtriggerregister+0x5c/0x1fc...

UBUNTU-CVE-2026-23368

In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy ledtriggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDSTRIGGERNETDEV and LEDTRIGGERPHY are enabled: 1362.049207 ledtriggerregister+0x5c/0x1fc...

CVE-2026-23368

CVE-2026-23368 — Linux kernel : A deadlock (AB-BA) occurs when both LED_TRIGGER_NETDEV and LED_TRIGGER_PHY are enabled. The issue stems from LED_TRIGGER_PHY registering LED triggers during phy_attach while holding RTNL and then acquiring triggers_list_lock, while LEDS_TRIGGER_NETDEV enables an LE...

CVE-2026-23368

In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy ledtriggers during probe to avoid AB-BA deadlock There is an AB-BA deadlock when both LEDSTRIGGERNETDEV and LEDTRIGGERPHY are enabled: 1362.049207 ledtriggerregister+0x5c/0x1fc...

PT-2026-36325

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the virt wifi component of the Linux kernel. The problem occurs because SET NETDEV DEVdev, &priv-lowerdev-dev is executed for virt wifi net devices, but...

CVE-2026-23273 macvlan: observe an RCU grace period in macvlan_common_newlink() error path

In the Linux kernel, the following vulnerability has been resolved: macvlan: observe an RCU grace period in macvlancommonnewlink error path valis reported that a race condition still happens after my prior patch. macvlancommonnewlink might have made @dev visible before detecting an error, and its...

CVE-2026-23273

The CVE refers to a Linux kernel macvlan race: macvlan_common_newlink() can reveal a device before error handling under an RCU grace period, leading to a use-after-free as shown by a KASAN report. Connected OSV entries confirm patches in Rootio-Linux for Root:Debian/Ubuntu variants (Root-OS-DEBIA...

PT-2026-35138

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Open vSwitch component of the Linux kernel. The ovs netdev tunnel destroy function may execute after the NETDEV UNREGISTER process has already detached the...

SUSE CVE-2026-23258

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setupnicdevices, the netdev is allocated using allocetherdevmq. However, the pointer to this structure is stored in oct-propsi.netdev only after the calls to...

PT-2026-34409

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the packet release function where a NETDEV UP event can re-register a socket into a fanout group's arr array. Because packet release does not zero the po-num...

CVE-2026-23258

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setupnicdevices, the netdev is allocated using allocetherdevmq. However, the pointer to this structure is stored in oct-propsi.netdev only after the calls to...