EUVD-2026-64559

In the Linux kernel, the following vulnerability has been resolved: net: atlantic: free RX pages of consumed but not refilled buffers aqringrxdeinit only walks swhead, swtail, the region posted to hardware. Since the page reuse strategy was added, a cleaned RX buffer keeps its page and its DMA...

CVE-2026-74622

CVE-2026-74622 is a resource leak in the Linux kernel's Aquantia (AQC) atlantic network driver. The function aq_ring_rx_deinit() only iterates over the [sw_head, sw_tail) region of the RX ring, but since the page reuse strategy was introduced, consumed-but-not-yet-refilled buffers reside in the c...

PT-2026-79627

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A memory leak occurs in the atlantic network driver when an interface is taken down. The aq ring rx deinit function only processes the region of the ring posted to hardware, failing to...

CVE-2026-72064

A flaw was found in the Linux kernel's mana network driver. When the driver allocates receive RX buffers from page pool fragments, it fails to perform an explicit synchronization for the CPU. This oversight can lead to data integrity issues or system instability on systems configured to require...

SUSE CVE-2026-74459

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

UBUNTU-CVE-2026-74459

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-74459

CVE-2026-74459 (Linux kernel) affects the can: etas_es58x driver, specifically es58x_read_bulk_callback(). When RX URB resubmission fails (usb_submit_urb()), the callback currently does not release the allocated coherent transfer buffer, causing a buffer leak. The fixes documented in multiple sou...

CVE-2026-72064

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-72064

CVE-2026-72064 relates to the Linux kernel net: mana RX path. When frag_count > 1, RX buffers are allocated from page pool fragments and remain DMA mapped; the RX completion path omits dma_unmap_single(), so the implicit CPU sync is not performed before passing data to the networking stack. Th...

CVE-2026-72064 net: mana: Sync page pool RX frags for CPU

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-72064 net: mana: Sync page pool RX frags for CPU

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

EUVD-2026-59022

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-72064 net: mana: Sync page pool RX frags for CPU

In the Linux kernel, the following vulnerability has been resolved: net: mana: Sync page pool RX frags for CPU MANA allocates RX buffers from page pool fragments when fragcount is greater than 1. In that case the buffers remain DMA mapped by page pool and the RX completion path does not call...

CVE-2026-74459: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: can: etases58x: es58xreadbulkcallback: fix RX buffer leak on URB resubmit failure es58xreadbulkcallback resubmits the RX URB after processing a received packet. If the resubmit succeeds, the URB remains anchored and will be handl...

CVE-2026-68129

A flaw was found in the Linux kernel's gve driver. Under extreme memory pressure, the driver's receive Rx buffer refill process can fail, causing the number of buffers available to hardware to drop below a critical threshold. This can lead to a permanent network queue stall, where the device drop...

CVE-2026-68135

A flaw was found in the Linux kernel's hip04 network driver. This vulnerability occurs when the buildskb function fails during the hip04rxpoll operation. The driver incorrectly proceeds without releasing the network receive RX buffer and its associated Direct Memory Access DMA mapping. This leads...

net: hip04: fix RX buffer leak on build_skb failure

...

CVE-2026-68124

In the Linux kernel, the following vulnerability has been resolved: mctp: serial: handle zero-length frames to prevent rx buffer overflow The MCTP serial receive state machine reads a frame length byte in mctpserialpushheader case 2 and validates it upper-bound-only: if c MCTPSERIALFRAMEMTU...

CVE-2026-68135

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...

CVE-2026-68135 net: hip04: fix RX buffer leak on build_skb failure

In the Linux kernel, the following vulnerability has been resolved: net: hip04: fix RX buffer leak on buildskb failure When buildskb fails in hip04rxpoll, the driver jumps to the refill path without releasing the current RX buffer and its DMA mapping. Installing a replacement buffer then overwrit...