CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

UBUNTU-CVE-2026-74478

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vectormmsgrx When vectormmsgrx discards a packet whose overlay header fails verifyheader, it frees the skb and continues the loop: if headercheck estats.rxencapserrors++; continue; The normal and...

CVE-2026-74492

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

CVE-2026-74558 xsk: reclaim invalid Tx descriptors in ZC batch path

In the Linux kernel, the following vulnerability has been resolved: xsk: reclaim invalid Tx descriptors in ZC batch path The zero-copy Tx batch parser stops when it encounters an invalid descriptor. If this happens after one or more continuation descriptors, the Tx consumer can be advanced past...

CVE-2026-74544

The CVE-2026-74544 issue is in the Linux kernel net/sched cls_u32 implementation. u32_change() copies offshift (unsigned char, 0-255) without bounds checks, enabling undefined behavior (shift-out-of-bounds) in u32_classify() when TC_U32_VAROFFSET is set and offshift ≥ 32. Public sources (Linux ke...

CVE-2026-74497

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

CVE-2026-74497 ALSA: usb-audio: Clamp frame size in implicit-feedback mode

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

EUVD-2026-59690

In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode sndusbhandlesyncurb scales received sync packet sizes by the sender's stride and stores the result directly in outpacket-packetsizei. If a connected USB device sends an...

EUVD-2026-59685

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

CVE-2026-74492

The CVE-2026-74492 entry concerns the Linux kernel netfilter ipset subsystem. Technical description across official and vendor advisories shows that during resize operations, mtype_resize() copies only comment pointers, while the old table is published for packet-side updates before the replaceme...

CVE-2026-74492 netfilter: ipset: do not update comments from kernel-side hash adds

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

CVE-2026-74492

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtyperesize copies comment pointers with memcpy, not the comment objects themselves. During the window after an entry has been copied but before the table swap a...

CVE-2026-74478 um: vector: fix use-after-free in vector_mmsg_rx()

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vectormmsgrx When vectormmsgrx discards a packet whose overlay header fails verifyheader, it frees the skb and continues the loop: if headercheck estats.rxencapserrors++; continue; The normal and...

EUVD-2026-59671

In the Linux kernel, the following vulnerability has been resolved: um: vector: fix use-after-free in vectormmsgrx When vectormmsgrx discards a packet whose overlay header fails verifyheader, it frees the skb and continues the loop: if headercheck estats.rxencapserrors++; continue; The normal and...

CVE-2026-74464 net: openvswitch: fix skb leak on flow key update failure during ct

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovsctexecute always steals or frees the skb on failure while ovsflowkeyupdate does not. So, if it fails and we return right away, the skb ends up leaked. Fix tha...

CVE-2026-74430

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix ACKALL packet handling rxrpcinputackall accepts ACKALL packets without checking whether the call is in a state that can legitimately have outstanding transmit buffers. A forged ACKALL can therefore reach a new service...

CVE-2026-74266

In the Linux kernel, the following vulnerability has been resolved: net/sched: schdualpi2: Do not call qdisctreereducebacklog during peek before restoring qlen Whenever dualpi2 drops packets during peek, it calls qdisctreereducebacklog. An issue arises because it calls qdisctreereducebacklog befo...

CVE-2026-72347

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtconnmark: reject invalid shift parameters Revision 2 of the CONNMARK target accepts user-controlled shift parameters and applies them to 32-bit mark values in connmarktgshift. A shiftbits value of 32 or more triggers...

CVE-2026-72348

In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matches check that the fixed extension header is present, then use the header length field to derive the advertised extension header lengt...

CVE-2026-72351

In the Linux kernel, the following vulnerability has been resolved: gue: validate REMCSUM private option length GUE private flags can indicate that remote checksum offload metadata is present. The private flags field itself is accounted for by guehdrflagslen, but guehdrprivflagslen currently...