CVE-2026-64007 netfilter: synproxy: refresh tcphdr after skb_ensure_writable

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

CVE-2026-64008 accel/rocket: fix UAF via dangling GEM handle in create_bo

In the Linux kernel, the following vulnerability has been resolved: accel/rocket: fix UAF via dangling GEM handle in createbo rocketioctlcreatebo inserts a GEM handle into the file's IDR via drmgemhandlecreate early on, then performs several operations that can fail sgt allocation, drmmm insert,...

CVE-2026-64006 netfilter: nf_tables: fix dst corruption in same register operation

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: fix dst corruption in same register operation For lshift and rshift, the shift operations are performed in a loop over 32-bit words. The loop calculates the shifted value and write it to dst, and then...

CVE-2026-64005 net/smc: Do not re-initialize smc hashtables

In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INITHLISTHEAD&smcvhashinfo.ht are called after smcnlinit, protoregister and sockregister. This can lead to smcvhashinfo.ht being reset even though hash entries already exist and are...

CVE-2026-64003 scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues

In the Linux kernel, the following vulnerability has been resolved: scsi: core: Run queues for all non-SDEVDEL devices from scsirunhostqueues While a SCSI host is in a recovery state, scsimqrequeuecmd will not set the requeue list for a requeued command to be kicked in the future. The expectation...

CVE-2026-64004 net/iucv: fix locking in .getsockopt

In the Linux kernel, the following vulnerability has been resolved: net/iucv: fix locking in .getsockopt Mirror iucvsocksetsockopt and wrap the whole switch in locksock/releasesock. The pre-existing SOMSGLIMIT-only lock becomes redundant and is removed. Any AFIUCV HIPER user can potentially crash...

CVE-2026-64002 ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table()

In the Linux kernel, the following vulnerability has been resolved: ipv4: free net-ipv4.sysctllocalreservedports after unregisternetsysctltable ipv4sysctlexitnet is currently freeing net-ipv4.sysctllocalreservedports too soon. Only after unregisternetsysctltable we can be sure no threads can...

CVE-2026-64001 ALSA: pcm: oss: Fix setup list UAF on proc write error

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix setup list UAF on proc write error sndpcmossprocwrite links a newly allocated setup entry into the OSS setup list before duplicating the task name. If the task-name allocation fails, the error path frees the...

CVE-2026-64000 net: hsr: fix potential OOB access in supervision frame handling

In the Linux kernel, the following vulnerability has been resolved: net: hsr: fix potential OOB access in supervision frame handling Ensure the entire TLV header is linearized before access by adding sizeofstruct hsrsuptlv to the pskbmaypull calls. Without this, a truncated frame could cause an...

CVE-2026-63999 ethtool: rss: fix indir_table and hkey leak on get_rxfh failure

In the Linux kernel, the following vulnerability has been resolved: ethtool: rss: fix indirtable and hkey leak on getrxfh failure rssprepareget allocates the indirection table and hash key buffer via rssgetdataalloc, then calls ops-getrxfh to populate them. If getrxfh fails, the function returns ...

CVE-2026-63998 ethtool: module: call ethnl_ops_complete() on module flash errors

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: call ethnlopscomplete on module flash errors When validate fails we are skipping over ethnlopscomplete even tho we already called ethnlopsbegin...

CVE-2026-63996 ethtool: cmis: require exact CDB reply length

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: require exact CDB reply length Malicious SFP module could respond with rpllen longer than what cmiscdbprocessreply expected, leading to OOB writes. Malicious HW is a bit theoretical but some modules may just be bug...

CVE-2026-63997 ethtool: module: avoid leaking a netdev ref on module flash errors

In the Linux kernel, the following vulnerability has been resolved: ethtool: module: avoid leaking a netdev ref on module flash errors moduleflashfwschedule is missing undo for setting the "inprogress" flag and taking the netdev reference. Delay taking these, the device can't disappear while we a...

CVE-2026-63995 ethtool: cmis: validate start_cmd_payload_size from module

In the Linux kernel, the following vulnerability has been resolved: ethtool: cmis: validate startcmdpayloadsize from module The CMIS firmware update code reads startcmdpayloadsize from the module's FW Management Features CDB reply and uses it directly as the byte count for memcpy. The destination...

CVE-2026-63993 vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached iphdr value after skbtunnelcheckpmtu skbtunnelcheckpmtu can change skb-head. Reusing oldiph afer skbtunnelcheckpmtu can cause an UAF. Use instead iphdrskb as done in drivers/net/bareudp.c and...

CVE-2026-63994 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

CVE-2026-63992 tunnels: do not assume transport header in iptunnel_pmtud_check_icmp()

In the Linux kernel, the following vulnerability has been resolved: tunnels: do not assume transport header in iptunnelpmtudcheckicmp In some cases, iptunnelpmtudcheckicmp can be called while skb transport header is not set. This triggers an out-of-bound access, because typeofskb-transportheader0...

EUVD-2026-45564

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

CVE-2026-63991 Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt()

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: 6lowpan: check skbclone return value in sendmcastpkt The skbclone function can return NULL if memory allocation fails. sendmcastpkt calls skbclone without checking the return value, which can lead to a NULL pointer...

CVE-2026-63991

The CVE CVE-2026-63991 concerns the Linux kernel Bluetooth 6lowpan path. The issue: skb_clone() may return NULL on allocation failure, and send_mcast_pkt() did not check this, risking a NULL pointer dereference in send_pkt() when dereferencing skb->data. The connected records indicate a fix wa...