CVE-2026-63929 iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf()

In the Linux kernel, the following vulnerability has been resolved: iio: buffer: Fix DMA fence leak in iiobufferenqueuedmabuf iiobufferenqueuedmabuf allocates a struct iiodmafence 104 bytes, kmalloc-128 via kmallocobj+dmafenceinit, which sets the initial kref to 1. It then calls dmaresvaddfence...

CVE-2026-63928 USB: serial: omninet: fix memory corruption with small endpoint

In the Linux kernel, the following vulnerability has been resolved: USB: serial: omninet: fix memory corruption with small endpoint Make sure that the bulk-out buffers are at least as large as the hardcoded transfer size to avoid user-controlled slab corruption should a malicious device report a...

CVE-2026-63926 bpf: sockmap: fix tail fragment offset in bpf_msg_push_data

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpfmsgpushdata When bpfmsgpushdata inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is...

CVE-2026-63927 usb: dwc2: Fix use after free in debug code

In the Linux kernel, the following vulnerability has been resolved: usb: dwc2: Fix use after free in debug code We're not allowed to dereference "urb" after calling usbhcdgivebackurb so save the urb-status ahead of time...

CVE-2026-63925 macsec: fix replay protection at XPN lower-PN wrap

In the Linux kernel, the following vulnerability has been resolved: macsec: fix replay protection at XPN lower-PN wrap In macsecpostdecrypt, when pn is U32MAX, pn + 1 overflows u32 to 0 and the first branch never fires. If nextpnhalves.lower is also in the upper half, pnsamehalfpn, lower is true...

CVE-2026-63924 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6hopjumbo ipv6hopjumbo calls pskbtrimrcsum, which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up...

CVE-2026-63923 octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify

In the Linux kernel, the following vulnerability has been resolved: octeontx2-af: validate body pcifunc in rvumboxhandlerrepeventnotify rvumboxhandlerrepeventnotify in drivers/net/ethernet/marvell/ octeontx2/af/rvurep.c queues a sender-controlled REPEVENTNOTIFY request body verbatim, and...

CVE-2026-63922 ipv6: exthdrs: refresh nh after handling HAO option

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh after handling HAO option ip6parsetlv caches skbnetworkheaderskb in nh while walking IPv6 TLVs. ipv6desthao may call pskbexpandhead for a cloned skb, which can move the skb head and invalidate the cached...

CVE-2026-63921 ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6siocdevprivate. After patch 1/2 in this series, vti6update unlinks and relinks the tunnel through t-net. vti6siocdevprivate still uses devnetdev for the collision lookup. For a tunnel moved through...

CVE-2026-63919 xfrm: input: hold netns during deferred transport reinjection

In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb-cb and uses it later from xfrmtransreinject. That pointer must stay valid until the deferred callback run...

CVE-2026-63920 ipv6: validate extension header length before copying to cmsg

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

CVE-2026-63918 l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname

In the Linux kernel, the following vulnerability has been resolved: l2tp: use refcountincnotzero in l2tpsessiongetbyifname A reader in l2tpsessiongetbyifname can return a pointer to a session whose refcount has reached zero. The getter takes its reference with plain refcountinc, but every other...

CVE-2026-63917 ip6: vti: Use ip6_tnl.net in vti6_changelink().

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6test netns ns2 ip -n ns2 link set vti6test type vti6 remote ::3...

CVE-2026-63916 HID: wacom: Fix OOB write in wacom_hid_set_device_mode()

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: Fix OOB write in wacomhidsetdevicemode wacomhidsetdevicemode currently assumes that the HIDDGINPUTMODE usage is always located in the first field field0 of the feature report. However, a device can specify...

CVE-2026-63915 nfc: hci: fix out-of-bounds read in HCP header parsing

In the Linux kernel, the following vulnerability has been resolved: nfc: hci: fix out-of-bounds read in HCP header parsing Both nfchcirecvfromllc and ncihcidatareceivedcb read packet-header from skb-data at function entry without first checking that the buffer holds at least one byte. A malicious...

CVE-2026-63914 xfrm: route MIGRATE notifications to caller's netns

In the Linux kernel, the following vulnerability has been resolved: xfrm: route MIGRATE notifications to caller's netns xfrmsendmigrate in net/xfrm/xfrmuser.c and pfkeysendmigrate in net/key/afkey.c both hardcode &initnet for the multicast that announces a successful XFRMMSGMIGRATE / SADBXMIGRATE...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63913 netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check An unintended behavior in the TCP conntrack state machine allows a connection to be forced into the CLOSE state using an RST packet with an...

CVE-2026-63911

CVE-2026-63911 (Linux kernel xfrm/iptfs) : The vulnerability arises in how IPTFS mode data is cloned during SA cloning. iptfs_clone_state() duplicates runtime objects (e.g., sk_buff_head, hrtimers, spinlocks, reassembly/reorder state) via kmemdup, which must not be shared with the original SA. If...

EUVD-2026-45684

In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: reset runtime state when cloning SAs iptfsclonestate clones the IPTFS mode data with kmemdup. This copies runtime objects which must not be shared with the original SA, including the embedded skbuffhead, hrtimers,...