3096 matches found
EUVD-2026-55517
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...
CVE-2026-68136 net: gro: fix double aggregation of flush-marked skbs
In the Linux kernel, the following vulnerability has been resolved: net: gro: fix double aggregation of flush-marked skbs Commit 0ab03f353d36 "net-gro: Fix GRO flush when receiving a GSO packet." added a flush check to skbgroreceive, but skbgroreceivelist lacks the same validation. As a result,...
CVE-2026-68135
The CVE-2026-68135 entry concerns the Linux kernel NIC driver hip04, where build_skb() failures in hip04_rx_poll() could bypass the release of the current RX buffer and its DMA mapping, causing resource leaks when a replacement buffer is installed. The fix keeps the current slot intact and return...
EUVD-2026-55516
In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...
CVE-2026-68129 gve: fix Rx queue stall on alloc failure
In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...
CVE-2026-68129
CVE-2026-68129 concerns the Linux kernel gve driver. Under extreme memory pressure, Rx buffer allocations can fail during the receive (Rx) buffer refill loop, causing the number of buffers posted to hardware to drop below a critical threshold and leading to a permanent queue stall. Consequences d...
EUVD-2026-55510
In the Linux kernel, the following vulnerability has been resolved: gve: fix Rx queue stall on alloc failure When the system is under extreme memory pressure, page allocations can fail during the Rx buffer refill loop. If the number of buffers posted to hardware falls below a critical low thresho...
CVE-2026-68124 mctp: serial: handle zero-length frames to prevent rx buffer overflow
In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...
PT-2026-69540
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the af iucv component. The system queues not-yet-received message notifications on iucv-message q, which hold raw pointers to the connection's iucv path...
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
...
ROS-20260806-73-0006
The vulnerability of the ax25kissrcv function in the ax25kissrcv module of the Linux operating system is related to improper release of resources. Exploiting this vulnerability can allow an attacker to cause a service failure...
EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2948)
According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...
EulerOS 2.0 SP15 : rsync (EulerOS-SA-2026-2907)
According to the versions of the rsync packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Rsync version 3.4.2 and prior contain an authorization bypass vulnerability in the rsync daemon's hostname-based access control list enforcement wh...
UBUNTU-CVE-2026-64577
In the Linux kernel, the following vulnerability has been resolved: gtp: check skbpulldata return in gtp1usendechoresp gtp1usendechoresp ignores skbpulldata's return value. Its caller gtp1uudpencaprecv only guarantees 16 bytes udphdr + gtp1header, but the pull requests 20 gtp1headerlong + udphdr...
MiracleLinux 8 : kernel-4.18.0-553.148.1.el8_10 (AXSA:2026-1465:59)
The remote MiracleLinux 8 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1465:59 advisory. kernel: ipv6: fix possible UAF in icmpv6rcv CVE-2026-53006 Tenable has extracted the preceding description block directly from the MiracleLinux security...
Use After Free
Overview Affected versions of this package are vulnerable to Use After Free in the HTTP/2 handling process when nghttp2sessionmemsend is called re-entrantly during the execution of nghttp2sessionmemrecv. An attacker can cause a heap-use-after-free condition by triggering concurrent or re-entrant...
CVE-2026-56848
A flaw in Node.js HTTP/2 handling allows nghttp2sessionmemsend to be called re-entrantly while nghttp2sessionmemrecv is executing, resulting in a heap-use-after-free. This vulnerability affects Node.js 26.x, 24.x, and 22.x...
PYSEC-2026-3586 OnionShare Receive mode writes uploaded files even when file uploads are disabled
Summary OnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still sen...
OnionShare Receive mode writes uploaded files even when file uploads are disabled
SummaryOnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still send...
