CVE-2026-74695

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

CVE-2026-74662

In the Linux kernel, the following vulnerability has been resolved: inet: frags: publish queues before arming timer inetfragcreate arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before th...

CVE-2026-74695

A reference count leak in the Linux kernel's netfilter flowtable module occurs when skb_dst_set_noref() is called on a socket buffer that already holds a ref-counted dst_entry from earlier RX or routing steps. The overwrite of skb->_skb_refdst leaks the prior reference and triggers a DEBUG_NET...

CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dstentry assigned during earlier RX or...

PT-2026-79700

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter flowtable offload hooks and XFRM offload path. Incoming socket buffers skbs may already possess a ref-counted dst entry from previous routing or RX steps...

Linux Distros Unpatched Vulnerability : CVE-2026-74695

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might...

CVE-2026-72463

A flaw was found in the Linux kernel's xfrm IP eXtensible FRamework for IPsec subsystem. This vulnerability occurs during asynchronous resumption where the xfrmrcvcb function can modify a network device without properly managing its reference count. This improper handling leads to a use-after-fre...

CVE-2026-72461

A flaw was found in the AppArmor security module of the Linux kernel. This vulnerability, a reference count leak when updating the skctx, occurs because a reference is unconditionally put by the caller even when it has been transferred. A local attacker could exploit this flaw to cause a denial o...

CVE-2026-72307

A flaw was found in the Linux kernel's mlxsw driver. When the mlxswspvrslpmtreereplace function encounters an error during Virtual Router VR replacement operations, its rollback mechanism fails to correctly release resources. This leads to a reference count leak, where system resources are not...

CVE-2026-72308

A flaw was found in the mlxsw driver of the Linux kernel. This vulnerability occurs when the mlxswspportlagjoin function fails to properly release a network resource reference, leading to a reference count leak. Over time, this leak could exhaust system resources, potentially resulting in a denia...

CVE-2026-72218

A flaw was found in the Linux kernel's lockd component. A reference count leak occurs when nlmdofopen fails on a cached file path. This prevents the file's reference count from returning to zero, causing a resource leak. Over time, this can lead to resource exhaustion and a Denial of Service DoS...

CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...

CVE-2026-74514 KVM: s390: pci: Fix memory accounting for pinned/unpinned pages

In the Linux kernel, the following vulnerability has been resolved: KVM: s390: pci: Fix memory accounting for pinned/unpinned pages The accountmem and unaccountmem functions call getuid which increments the reference count of struct userstruct on every invocation. But we don't decrement the count...

CVE-2026-72376

In the Linux kernel, the following vulnerability has been resolved: afs: Fix misplaced inc of net-cellsoutstanding Fix net-cellsoutstanding being incremented before the check for failure of idralloccyclic, leaving the count incremented on error...

CVE-2026-72463 xfrm: Fix dev use-after-free in xfrm async resumption

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb-dev refcnt until after transportfinish. However, xfrmrcvcb may modify skb-dev to tunnel dev without taking device reference, such as vtircvcb. T...

PT-2026-72229

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A reference count leak exists in the i ipmi request function. When a caller provides a supplied recv message, the function increments the nr msgs reference count. If an error occurs, the...

CVE-2026-68122

A flaw was found in the Linux kernel's ovpn module. A race condition in the TCP error handling paths can lead to a reference count leak. This occurs when an internal object's reference count is incremented twice but decremented only once, preventing the object from being properly released. Over...

CVE-2026-68122

CVE-2026-68122: Linux kernel ovpn code has a race in TCP error paths where ovpn_peer_hold() refs can be leaked if schedule_work() is already pending. The fix is to check schedule_work() return value on both RX/TX error paths and drop the extra reference with ovpn_peer_put() when the work is alrea...

CVE-2026-64301

A flaw was found in the Linux kernel's regulator subsystem. An issue in the scmiregulatorprobe function can lead to a reference count leak. This occurs when an error path is triggered during device node processing, causing a resource to not be properly released. Over time, this unreleased resourc...

CVE-2026-64321

A flaw was found in the NVMe over RDMA nvmetrdma target in the Linux kernel. When a host queue backlog is exceeded during a connection attempt, a reference count kref is not properly released. This oversight can lead to a resource exhaustion vulnerability, potentially allowing a remote attacker t...