CVE-2026-68425

CVE-2026-68425 in the Linux kernel relates to IB/mad RMPP receive processing. Previously, DATA responses could begin reassembly before being matched to an outstanding send, allowing an unsolicited response that routes to a kernel RMPP agent to allocate or extend RMPP receive state before full TID...

EUVD-2026-55584

In the Linux kernel, the following vulnerability has been resolved: ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF pppol2tprecv runs in the L2TP UDP-encap softirq RX path: l2tpudpencaprecv - l2tprecvcommon - pppol2tprecv - pppinput&po-chan It runs under rcureadlock holding...

EUVD-2026-55565

In the Linux kernel, the following vulnerability has been resolved: tcp: fix TIMEWAIT socket reference leak on PSP policy failure Release the TIMEWAIT socket reference and jump to discardit upon PSP policy failure in both IPv4 and IPv6 receive paths. This prevents a memory leak of tcptwbucket...

CVE-2026-68379

The CVE pertains to the Linux kernel and describes a fix for a TIME_WAIT socket reference leak caused by PSP policy failure in both IPv4 and IPv6 receive paths. The underlying issue was that TIME_WAIT socket references were not released correctly when PSP policy checks failed, leading to memory l...

EUVD-2026-55562

In the Linux kernel, the following vulnerability has been resolved: sctp: fix authhmacs array size in struct sctpcookie The authhmacs array in struct sctpcookie is supposed to store a complete SCTPAUTHHMACALGO parameter, which consists of a struct sctpparamhdr followed by N HMAC identifiers...

EUVD-2026-55561

In the Linux kernel, the following vulnerability has been resolved: bnxten: Handle partially initialized auxiliary devices bnxtauxdevicesinit calls auxiliarydeviceinit before all fields used by bnxtauxdevrelease are initialized. After auxiliarydeviceinit succeeds, later errors must unwind with...

CVE-2026-68323

Summary of CVE-2026-68323 (tipc): In Linux kernel TIPC, udp bearer replication list updates (ub->rcast.list) were updated by tipc_udp_rcast_add() and cleanup_bearer() without proper serialization, racing via encap softirq and workqueue paths. This could corrupt the list (list_del corruption) d...

EUVD-2026-55424

In the Linux kernel, the following vulnerability has been resolved: tipc: serialize udp bearer replicast list updates tipcudprcastadd and cleanupbearer both update ub-rcast.list with listaddrcu / listdelrcu, but nothing serializes them. The add runs from the encap receive softirq via...

EUVD-2026-55402

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix memory leak on slave unregistration by removing synced VLANs When an HSR master device is brought UP, it auto-adds VLAN 0 via vlanvid0add, which propagates VID 0 to its slave devices slave A and B. If a slave device...

CVE-2026-68300

The documents describe CVE-2026-68300 in the Linux kernel SCTP auth path, where sctp_auth_chunk_verify() improperly returns true when auth_chunk is NULL, allowing skipped authentication. Two scenarios cause this: skb_clone() failing in BH receive path leaving auth_chunk NULL (new connections, aso...

EUVD-2026-55378

In the Linux kernel, the following vulnerability has been resolved: drm/dp/mst: fix OOB reads on 2-byte fields in sideband reply parsers Three sideband reply parsers read 16-bit fields as: val = raw-msgidx msgidx+1; and check bounds only after the fact. When idx == raw-curlen, raw-msgidx+1 reads...

CVE-2026-68244

The CVE relates to the Linux kernel DRM/I915 GEM component. After a BALANCE/PARALLEL_SUBMIT extension during context creation, an error in processing the next user extension could leak the siblings[] array; this has been resolved. The fix is cherry-picked from commit aa65e0a4b51b3b54b53e4142aaa2d...

CVE-2026-68161

CVE-2026-68161 affects the Linux kernel SCTP UDP tunnel implementation. When net.sctp.udp_port is configured, proc_sctp_do_udp_port() creates per-net SCTP UDP tunneling sockets; the netns exit path did not stop these sockets, so a namespace could be torn down with the UDP tunnel sockets still ins...

EUVD-2026-55547

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

EUVD-2026-55526

In the Linux kernel, the following vulnerability has been resolved: net: slip: serialize receive against buffer reallocation slreallocbufs replaces rbuff and updates buffsize while holding sl-lock. slipreceivebuf reads those fields and writes through rbuff without holding the lock. An MTU change...

CVE-2026-68142

The Linux kernel vulnerability CVE-2026-68142 affects the geneve tunnel implementation. It occurs in the changelink flow for Geneve devices where the boundary of CAP_NET_ADMIN is checked only against the dev_net, allowing an attacker privileged in that netns but not in the geneve->net underlay...

EUVD-2026-55518

In the Linux kernel, the following vulnerability has been resolved: net/x25: fix use-after-free in x25killbyneigh x25killbyneigh walks the global X.25 socket list looking for sockets attached to a terminating neighbour. x25listlock protects list membership while the lookup is in progress, but it...

EUVD-2026-55515

In the Linux kernel, the following vulnerability has been resolved: ptp: ptps390: Add missing facility check Only register the physical clock when facility 28 is installed and PTFF QAF returns that PTFF QPT is available...

CVE-2026-68134

CVE-2026-68134 pertains to the Linux kernel, specifically the ptp_s390 driver. The issue arises from a missing facility check when registering the physical clock, which could occur unless facility 28 is installed and PTFF QAF indicates that PTFF QPT is available. The fix adds the required facilit...

CVE-2026-68133

The CVE concerns the Linux kernel ice driver’s PTP handling. A PF reset when PTP state is ICE_PTP_UNINIT could cause ice_ptp_rebuild() to set the state to ICE_PTP_ERROR, producing a PTP release call trace during driver unload (ice_ptp_release -> ice_deinit_features.part.0 -> ice_remove). Th...