PT-2026-72206

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The MACB driver leaks outgoing SKBs Socket Buffers, which are data structures used to manage network packets that have not been marked as completed. These buffers reside in queue-tx skb...

PT-2026-72916

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs ct execute always steals or frees the skb on failure while ovs flow key update does not. So, if it fails and we return right away, the skb ends up leaked. Fi...

PT-2026-72942

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipc sk dump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sk lock.slock, but tipc poll...

PT-2026-72630

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nf flow ip6 tunnel proto to use pskb may pull instead of skb header pointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequen...

PT-2026-72438

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack reasm: guard mac header adjustment after IPv6 defrag nf ct frag6 reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-mac header: skb-mac header +=...

PT-2026-72746

In the Linux kernel, the following vulnerability has been resolved: vhost/net: complete zerocopy ubufs only once vhost-net initializes one ubuf info per outstanding zerocopy TX descriptor and hands it to the backend socket. The networking stack may then clone a zerocopy skb before all skb...

Linux Distros Unpatched Vulnerability : CVE-2026-72057

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/sched: actct: preserve tcskbcb across defragmentation tcfcthandlefragments calls nfcthandlefragments without saving and restoring skb-cb. The defrag helper...

PT-2026-72441

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conntrack sip: validate skb dst before accessing it tc ingress and openvswitch do not guarantee routing information to be available. These subsystems use the conntrack helper infrastructure, and the SIP helper relie...

PT-2026-72759

In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7996: Fix possible token leak in mt7996 tx prepare skb If link conf or link sta lookup fails in mt7996 tx prepare skb routine, mt7996 driver leaks an already allocated tx token. Fix the issue releasing the token in...

PT-2026-72871

In the Linux kernel, the following vulnerability has been resolved: rxrpc: rxrpc verify data ensure rx dec buffer alloc rxrpc recvmsg data calls rxrpc verify data whenever the rxrpc call.rx dec buffer is unallocated and assumes that upon successful return that rx dec buffer must be allocated...

PT-2026-72581

In the Linux kernel, the following vulnerability has been resolved: eth: fbnic: don't cache shinfo across skb realloc fbnic tx lso calls skb cow head which may reallocate the skb including the shared info. We can't use the pointer calculated before the call. BUG: KASAN: slab-use-after-free in fbn...

PT-2026-72522

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: fix malformed ISO END/CONT handling Core specification Part C vol 4 sec 5.4.5 does not exclude empty ISO CONT, ISO END packets. We currently reject them if they are last. If controller sends malformed sequence ISO...

PT-2026-72345

In the Linux kernel, the following vulnerability has been resolved: net: thunderbolt: Fix frags overflow by bounding frame count tbnet poll assembles a multi-frame ThunderboltIP packet into one skb. The first frame goes into the skb linear area and every further frame is added as a page fragment...

PT-2026-72997

In the Linux kernel, the following vulnerability has been resolved: rtase: fix double free of multi-frag skb on DMA map failure In rtase start xmit, when the head buffer DMA mapping fails after rtase xmit frags has mapped all fragments, the error path clears the fragment descriptors with rtase tx...

PT-2026-72696

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf dup netdev: add nf dev xmit recursion helpers and use them Update nft dup and nft fwd to use the nf dev xmit recursion helpers. This patch also disables BH when transmitting the skb to address a possible migration t...

PT-2026-73012

In the Linux kernel, the following vulnerability has been resolved: xsk: fix buffer leak in xsk drop skb for AF XDP multi-buffer Tx This patch is inspired by the check1 from sashiko. It says when overflow happens, the address of cq to be published is invalid. Actually the severer thing is the who...

Linux Distros Unpatched Vulnerability : CVE-2026-74545

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rtase: fix double free of multi-frag skb on DMA map failure In rtasestartxmit, when the head buffer DMA mapping fails after rtasexmitfrags has mapped all...

PT-2026-72246

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/sched component where the tcf ct handle fragments function calls nf ct handle fragments without saving and restoring the skb-cb control buffer. Because the...

PT-2026-72507

In the Linux kernel, the following vulnerability has been resolved: ipvs: ensure inner headers in ICMP errors are in headroom Sashiko points out that after stripping the outer headers with pskb pull we should ensure the inner IP headers in ICMP errors from tunnels are present in the skb headroom...

SUSE CVE-2026-68302

In the Linux kernel, the following vulnerability has been resolved: amt: re-read skb header pointers after every pull Several AMT receive and transmit paths cache a pointer into the skb head iphdr, ipv6hdr, ethhdr or the AMT message header and then call a helper that can reallocate that head befo...