CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...

EUVD-2026-45817

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

CVE-2026-64132 ipv6: ioam: refresh hdr pointer before ioam6_event()

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

CVE-2026-64132

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6event Reported by Sashiko: In ipv6hopioam, the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skbensurewritable, which might reallocate the...

EUVD-2026-45802

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...

CVE-2026-64117 wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...

CVE-2026-64117 wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb

In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: capture fast-RX rate before mesh reuses skb-cb ieee80211invokefastrx reads RX status through IEEE80211SKBRXCBskb, which aliases the same skb-cb storage that ieee80211rxmeshdata reuses as IEEE80211TXINFO. In the...

EUVD-2026-45798

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevfcleanrxirq prunes frames whose source MAC matches the VF's own address VEPA multicast workaround by freeing the skb and continuing to the next descriptor:...

CVE-2026-64113

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevfcleanrxirq prunes frames whose source MAC matches the VF's own address VEPA multicast workaround by freeing the skb and continuing to the next descriptor:...

CVE-2026-64113

In the Linux kernel, the following vulnerability has been resolved: ixgbevf: fix use-after-free in VEPA multicast source pruning ixgbevfcleanrxirq prunes frames whose source MAC matches the VF's own address VEPA multicast workaround by freeing the skb and continuing to the next descriptor:...

CVE-2026-64110 igc: fix potential skb leak in igc_fpe_xmit_smd_frame()

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igcfpexmitsmdframe When igcfpeinittxdescriptor fails, no one takes care of an allocated skb, leaking it. 1 Use devkfreeskbany on failure. Tested on an I226 adapter with the following command, while...

CVE-2026-64110

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igcfpexmitsmdframe When igcfpeinittxdescriptor fails, no one takes care of an allocated skb, leaking it. 1 Use devkfreeskbany on failure. Tested on an I226 adapter with the following command, while...

CVE-2026-64110 igc: fix potential skb leak in igc_fpe_xmit_smd_frame()

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igcfpexmitsmdframe When igcfpeinittxdescriptor fails, no one takes care of an allocated skb, leaking it. 1 Use devkfreeskbany on failure. Tested on an I226 adapter with the following command, while...

CVE-2026-64110

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igcfpexmitsmdframe When igcfpeinittxdescriptor fails, no one takes care of an allocated skb, leaking it. 1 Use devkfreeskbany on failure. Tested on an I226 adapter with the following command, while...

CVE-2026-64109 af_unix: Fix UAF read of tail->len in unix_stream_data_wait()

In the Linux kernel, the following vulnerability has been resolved: afunix: Fix UAF read of tail-len in unixstreamdatawait unixstreamdatawait does skbpeektail&sk-skreceivequeue without holding any lock that prevents SKBs on that queue from being dequeued and freed. This has been the case since...

CVE-2026-64055

The CVE-2026-64055 issue is in the Linux kernel ethernet cortina driver (gmac_rx NAPI poll). A fragment counter (frag_nr) used to assemble SKB fragments could be reset to zero when the ring buffer emptied during a poll, leaving an incomplete SKB. The fix makes the RX fragment counter part of the ...

CVE-2026-64056

The CVE covers a Linux kernel issue in the Cortina ethernet driver. The RX socket buffer (SKB) used to assemble fragments in gmac_rx() was a static local variable, which could race on devices with two ethernet ports (Gemini) when both ports are active. The fix makes the RX SKB a per-port variable...

CVE-2026-64056 net: ethernet: cortina: Make RX SKB per-port

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Make RX SKB per-port The SKB used to assemble packets from fragments in gmacrx is static local, but the Gemini has two ethernet ports, meaning there can be races between the ports on a bad day if a device ...

CVE-2026-64024 tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...

CVE-2026-64024 tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...