CVE-2026-31665

CVE-2026-31665 affects the Linux kernel netfilter nf_conntrack timeout destruction. The issue is a use-after-free where nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), potentially leaving RCU-protected references active. The documented fix d...

CVE-2026-31665

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix use-after-free in timeout object destroy nftcttimeoutobjdestroy frees the timeout object with kfree immediately after nfctuntimeout, without waiting for an RCU grace period. Concurrent packet processing on...

CVE-2026-31665

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix use-after-free in timeout object destroy nftcttimeoutobjdestroy frees the timeout object with kfree immediately after nfctuntimeout, without waiting for an RCU grace period. Concurrent packet processing on...

EUVD-2026-25558

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix use-after-free in timeout object destroy nftcttimeoutobjdestroy frees the timeout object with kfree immediately after nfctuntimeout, without waiting for an RCU grace period. Concurrent packet processing on...

CVE-2026-31642 rxrpc: Fix call removal to use RCU safe deletion

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet-calls list to use listdelrcu rather than listdelinit to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an...

EUVD-2026-25472

In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exitrtnl callback instead of manual rtnllock in preexit wgnetnspreexit manually acquires rtnllock inside the pernet .preexit callback. This causes a hung task when another thread holds rtnlmutex - the...

CVE-2026-31579 wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit

In the Linux kernel, the following vulnerability has been resolved: wireguard: device: use exitrtnl callback instead of manual rtnllock in preexit wgnetnspreexit manually acquires rtnllock inside the pernet .preexit callback. This causes a hung task when another thread holds rtnlmutex - the...

CVE-2026-31541 tracing: Fix trace_marker copy link list updates

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix tracemarker copy link list updates When the "copytracemarker" option is enabled for an instance, anything written into /sys/kernel/tracing/tracemarker is also copied into that instances buffer. When the option is set...

PT-2026-34994

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the rxrpc component where call removal from the rxnet-calls list used list del init instead of list del rcu. This could lead to an infinite loop when reading...

PT-2026-35017

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the netfilter nft ct component. The function nft ct timeout obj destroy frees the timeout object using kfree immediately after nf ct untimeout, without...

PT-2026-34893

In the Linux kernel, the following vulnerability has been resolved: tracing: Fix trace marker copy link list updates When the "copy trace marker" option is enabled for an instance, anything written into /sys/kernel/tracing/trace marker is also copied into that instances buffer. When the option is...

CVE-2026-31532

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro-uniq use-after-free in rawrcv rawrelease unregisters raw CAN receive filters via canrxunregister, but receiver deletion is deferred with callrcu. This leaves a window where rawrcv may still be running in an RCU...

CVE-2026-31532 can: raw: fix ro->uniq use-after-free in raw_rcv()

In the Linux kernel, the following vulnerability has been resolved: can: raw: fix ro-uniq use-after-free in rawrcv rawrelease unregisters raw CAN receive filters via canrxunregister, but receiver deletion is deferred with callrcu. This leaves a window where rawrcv may still be running in an RCU...

SUSE CVE-2026-31526

In the Linux kernel, the following vulnerability has been resolved: bpf: Fix exception exit lock checking for subprogs processbpfexitfull passes checklock = !curframe to checkresourceleak, which is false in cases when bpfthrow is called from a static subprog. This makes checkresourceleak to skip...

Linux kernel 安全漏洞

The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the reuse of a freed resource after the release of the ro-uniq operation in rawrcv. This could le...

CVE-2026-31526

Summary: CVE-2026-31526 concerns the Linux kernel BPF verifier. A defect in exception exits for BPF subprograms allowed ORC unwinding to proceed without releasing user-held locks, risking resource leaks and instability. The root cause: process_bpf_exit_full() could set check_lock=false for except...

kernel: smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match()

A flaw was found in the Linux kernel’s SMC Shared Memory Communication module: in smcclcprfxmatch, the function is called from smclistenwork without proper RCU or RTNL protection. The code previously used skdstgetsk-dev, which can lead to a use-after-free UAF condition if the sk’s destination is...

PT-2026-34413

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the openvswitch component of the Linux kernel where a network device netdev may be released before the teardown process is fully completed. This occurs because the ovs...

Linux Distros Unpatched Vulnerability : CVE-2026-31526

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Fix exception exit lock checking for subprogs processbpfexitfull passes checklock = !curframe to checkresourceleak, which is false in cases when bpfthrow i...

Unity Linux 20.1070a Security Update: kernel (UTSA-2026-013633)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-013633 advisory. In the Linux kernel, the following vulnerability has been resolved: rcu: Fix thiscpuread lockdep warning in rcuforcequiescentstate Running rcutorture with non-zero...