CVE-2026-43503

🚨 CVE-2026-43503 — DirtyClone When Shared Memory Stops Being Shared Safely. A Local Privilege Escalation vulnerability caused by improper propagation of the SKBFLSHAREDFRAG flag inside the Linux networking stack. 📖 Overview CVE-2026-43503 , nicknamed DirtyClone , is a High Severity Local Privileg...

pppoeject

PPPoEject — Sitio de seguimiento del use-after-free de PPPoE en el kernel de Linux Código fuente del rastreador de estado de parches de PPPoEject : un sitio de una sola página que registra qué distribuciones han publicado una corrección para el use-after-free del skb-head obsoleto en sendmsg de...

CVE-2026-64563_EXP

CVE-2026-64563EXP 仅供实验研究，prefetch和nperm的代码（需要设置的内存参考set.gdb）未附加，未进行优化命中概率低 作者关注到该漏洞作者已发布该漏洞相关信息：https://github.com/google/security-research/pull/414 利用思路截然不同，由于未完整验证该利用思路持保守意见（主要是sock自旋锁是否能竞态作者并未实测，按照代码片面理解可以通过timerfd硬中断进行竞态） 前置分析：https://xz.aliyun.com/news/92649...

Linux Distros Unpatched Vulnerability : CVE-2026-90160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modif...

Linux Distros Unpatched Vulnerability : CVE-2026-90222

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, ...

Oracle Linux 10 : kernel (ELSA-2026-68507)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-68507 advisory. - wifi: ath9k: hifusb: don't dereference hifdev after re-arming firmware request Izabela Bakollari RHEL-241004 CVE-2026-68363 - wifi: iwlwifi: mld:...

Linux Distros Unpatched Vulnerability : CVE-2026-90071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it...

AZL-102695 CVE-2026-90417 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/cxgb4: Fix deregskb leak and double free in writetptentry When the device is in the fatal error state, writetptentry returns -EIO before handing the caller's preallocated skb to the transmit path; its allocation-failure...

DEBIAN-CVE-2026-90222

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

AZL-102935 CVE-2026-90160 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: lwtbpf: Restore reserved headroom after xmit program ipfinishoutput2 expands an skb to LLRESERVEDSPACEdev before LWT xmit. An LWTXMIT BPF program can then modify the skb head and still return BPFOK, so bpfxmit rechecks the...

DEBIAN-CVE-2026-90145

In the Linux kernel, the following vulnerability has been resolved: hinic3: Fix skb linearization mismatch and drop skb when skbchecksumhelp failed Previously, hinic3sendoneskb cached the skb fragment count before calling hinic3txoffload. If hinic3txcsum falls back to skbchecksumhelp for...

DEBIAN-CVE-2026-90071

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

CVE-2026-90071

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

AZL-101894 CVE-2026-90071 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: schteql: restore skb-dev on the slave failure path teqlmasterxmit sets skb-dev = slave before calling the slave's ndostartxmit, but never restores it when that transmit fails. The skb then walks on to the next slave...

CVE-2026-90051

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

DEBIAN-CVE-2026-90051

In the Linux kernel, the following vulnerability has been resolved: tcp: reject non zerocopy devmem tx Devmem tcp tx doesn't work without zero-copy, however it's not currently enforced if NETIFFSG isn't present. In this case, tcpsendmsglocked will try the copy path and try to copy data from an...

CVE-2026-93149 wifi: mac80211_hwsim: avoid NULL skb in stop queue drain

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211hwsim: avoid NULL skb in stop queue drain mac80211hwsimstop drops any frames left in data-pending. The loop currently checks skbqueueempty and then dequeues separately. That split is racy with TX status handling,...

CVE-2026-90222 nfc: pn533: hold a reference to the request skb during send_frame

In the Linux kernel, the following vulnerability has been resolved: nfc: pn533: hold a reference to the request skb during sendframe pn533sendasync publishes the command and then calls dev-phyops-sendframe. Once dev-cmd is set, an incoming frame can be matched to this command: the I2C threaded IR...

CVE-2026-90222

CVE-2026-90222 is a use-after-free race condition in the Linux kernel's NFC PN533 driver (nfc/pn533). When __pn533_send_async() publishes a command and invokes send_frame(), an incoming I2C frame can trigger command completion, which frees the request skb via consume_skb(). On the I2C transport, ...

CVE-2026-90160

CVE-2026-90160 affects the Linux kernel 's lightweight tunnel BPF subsystem (lwt_bpf). When an LWT_XMIT BPF program modifies the skb head, the post-program headroom recheck in bpf_xmit() uses dst->dev->hard_header_len (14 bytes on Ethernet) instead of LL_RESERVED_SPACE(dev) (16 bytes). Sinc...