CVE-2026-74626

A flaw was found in the Linux kernel's Non-Transparent Bridge NTB virtual ethernet device ntbnetdev. When processing incoming network packets, a failure to allocate a new buffer can lead to the removal of an existing buffer from the receive queue without replacement. Repeated occurrences of this...

CVE-2026-74665

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, bpfprogrungenericxdp copies xdpfragssize back to...

PT-2026-79670

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp buff. If an XDP program adjusts the fragment area, bpf prog run generic xdp copies xdp frags size back t...

CVE-2026-49430

In the ZFS_IOC_RECV_NEW heal path, OpenZFS truncates a 64-bit payload size to 32-bit for allocation but uses the original 64-bit size as the byteswap length, causing a heap overflow exploitable by any local user with the "receive" delegated permission. Fixed in FreeBSD 14.3/14.4/15.0/15.1 release...

Linux Distros Unpatched Vulnerability : CVE-2026-72465

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The outnorqst exit in...

CVE-2026-72121

A flaw was found in the Linux kernel's Controller Area Network CAN Broadcom bcm driver. A race condition exists when the driver attempts to update filter and timer values simultaneously with ongoing receive operations. This can lead to the transmission of stale CAN reply frames with an incorrect...

UBUNTU-CVE-2026-74455

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74460

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74460 can: ems_usb: validate CPC message lengths

In the Linux kernel, the following vulnerability has been resolved: can: emsusb: validate CPC message lengths emsusbreadbulkcallback walks CPC messages packed in one USB receive buffer. Check that each declared message fits in the URB payload. Also require the type-specific payload to cover the...

CVE-2026-74460

The CVE-2026-74460 issue affects the Linux kernel’s ems_usb path for CPC messages. The vulnerability arises in can: ems_usb: validate CPC message lengths, where ems_usb_read_bulk_callback() processes CPC messages in a USB receive buffer. The fix enforces that each declared CPC message fits within...

CVE-2026-74455 can: peak_usb: validate uCAN receive record lengths

In the Linux kernel, the following vulnerability has been resolved: can: peakusb: validate uCAN receive record lengths pcanusbfddecodebuf walks uCAN records packed in one USB receive buffer. Require each record to contain the fixed header for its type, and verify CAN payload bytes before copying...

CVE-2026-74455

The CVE-2026-74455 vulnerability in the Linux kernel concerns the peak_usb driver for CAN (uCAN) payloads. pcan_usb_fd_decode_buf() parses multiple CAN records packed in a single USB receive buffer and now requires each record to include the fixed header for its type and validates the CAN payload...

CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-72464

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

CVE-2026-74377

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Copy WQE to local buffer in non-SRQ receive path For non-SRQ QPs, the responder reads WQE fields directly from the shared queue buffer mapped into userspace. This allows a malicious user to modify fields like numsge or...

UBUNTU-CVE-2026-72464

In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdmawcreceive decrements the transport's Receive count for every completion before it dispatches a successful Receive to rpcrdmareplyhandler. The handler must post a...

EUVD-2026-59553

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74406

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-74406 vxlan: Fix potential null-ptr-deref in vxlan_gro_prepare_receive().

In the Linux kernel, the following vulnerability has been resolved: vxlan: Fix potential null-ptr-deref in vxlangropreparereceive. udptunnelsockrelease could set sk-skuserdata to NULL while vxlangropreparereceive is running. Let's check if rcudereferenceskuserdata is NULL after skbgroremcsuminit...

CVE-2026-72500 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...