CVE-2026-80978

CVE-2026-80978 affects the Linux kernel IP tunnel networking subsystem. IP tunnel devices derive their advertised needed_headroom from lower output devices; a stack of user-created devices can make this value exceed what 16-bit skb header offsets can represent, causing skb head expansion to wrap ...

EUVD-2026-76301

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

CVE-2026-80978 net: cap advertised IP tunnel headroom

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised neededheadroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

EUVD-2026-76300

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80977 net: skbuff: don't touch shared zerocopy state in skb_tx_error()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skbtxerror skbtxerror completes the zerocopy uarg and clears SKBFLALLZEROCOPY, and skbzcopydowngrademanaged clears SKBFLMANAGEDFRAGREFS. Both live in skbshinfo, which every clone...

CVE-2026-80941

CVE-2026-80941 affects the Linux kernel wifi: rtw88 driver. The root cause is in rtw_txq_push_skb() : when the skb passed to rtw_hci_tx_write() fails, the error path does not free the skb before returning. This leads to a potential memory leak in rtw_txq_push() , where a dequeued skb is passed to...

EUVD-2026-76264

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

CVE-2026-80941 wifi: rtw88: Fix potential memory leak in rtw_txq_push_skb()

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtwtxqpushskb The skb passed to the rtwhcitxwrite is expected to be freed when the function fails, but the error path in rtwtxqpushskb does not free the skb before returning. This can lea...

PT-2026-90107

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: don't touch shared zerocopy state in skb tx error skb tx error completes the zerocopy uarg and clears SKBFL ALL ZEROCOPY, and skb zcopy downgrade managed clears SKBFL MANAGED FRAG REFS. Both live in skb shinfo, which...

PT-2026-90071

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: Fix potential memory leak in rtw txq push skb The skb passed to the rtw hci tx write is expected to be freed when the function fails, but the error path in rtw txq push skb does not free the skb before returning. Thi...

PT-2026-90130

In the Linux kernel, the following vulnerability has been resolved: net: tun: bound receive headroom tun get user uses tun-align both as skb headroom and when choosing how much packet data to keep linear. OVS can propagate an oversized headroom request from another port to TUN or TAP. When align ...

PT-2026-90279

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: use skb cow head in ip6 tnl xmit ip6 tnl xmit may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skb realloc headroom, copies skb-sk ownership, consum...

PT-2026-90118

In the Linux kernel, the following vulnerability has been resolved: NTB: ntb transport: Fail TX enqueue when the QP link is down Commit f195a1a6fe41 "ntb: Drop packets when qp link is down" meant to make ntb transport tx enqueue drop packets submitted while the QP link is down, but it only return...

PT-2026-90281

In the Linux kernel, the following vulnerability has been resolved: ipip: fix skb leak in collect md mode when metadata dst allocation fails In collect md mode ipip tunnel rcv returns 0 without freeing the skb when ip tun rx dst fails to allocate the metadata dst. ipip rcv and mplsip rcv are...

PT-2026-90117

In the Linux kernel, the following vulnerability has been resolved: NTB: ntb transport: Reject oversized TX buffers ntb process tx handles an oversized buffer by calling tx handler with a NULL data pointer and returning success. ntb netdev therefore neither frees the skb in its completion callbac...

PT-2026-90108

In the Linux kernel, the following vulnerability has been resolved: net: cap advertised IP tunnel headroom IP tunnel devices derive their advertised needed headroom from lower output devices. A stack of user-created devices can make the derived value larger than the 16-bit skb header offsets can...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — 研究ノート 概要 このリポジトリは、Dirty Frag として広く知られ、xfrm-ESP パスでは CVE-2026-43284 として追跡されている Linux カーネルの脆弱性に関する、整理された技術図と補足ノートを含んでいます。 この問題は、Hyunwoo Kim @v4bel によって発見された、より広範な Dirty Frag クラスに属します。関連する RxRPC の亜種は CVE-2026-43500 として別途追跡されています。 この資料の目的は次のとおりです。 システムレベルでバグのメカニズムを説明すること...

CVE-2026-31429-POC

CVE-2026-31429 — Linux 内核：通过 bpfprogtestrunskb 对 KFENCE 分配的 SKB 头部进行跨缓存释放 严重性： 中危（CWE-763：释放无效指针或引用） 发布时间： 2026-04-20 受影响子系统： net/core/skbuff.c — skbkfreehead 研究人员： Antonius / w1sdom — Blue Dragon Security 联系方式： [email protected] Lore 线程：...

CVE-2026-64563_EXP

CVE-2026-64563EXP 仅供实验研究，prefetch和nperm的代码（需要设置的内存参考set.gdb）未附加，未进行优化命中概率低 作者关注到该漏洞作者已发布该漏洞相关信息：https://github.com/google/security-research/pull/414 利用思路截然不同，由于未完整验证该利用思路持保守意见（主要是sock自旋锁是否能竞态作者并未实测，按照代码片面理解可以通过timerfd硬中断进行竞态） 前置分析：https://xz.aliyun.com/news/92649...

kernel: ice: fix double-free of tx_buf skb

A flaw was found in the Linux kernel's ice network driver. An error in the driver's handling of network packet transmission, specifically when icetso or icetxcsum functions fail, can lead to a double-free of a network buffer skb. This occurs because a transmit buffer txbuf may still point to an...