CVE-2026-74620

This Linux kernel vulnerability affects the net/sched subsystem, specifically the act_gact and act_police traffic control actions. The fallback control actions (TCA_GACT_PROB.paction and TCA_POLICE_RESULT) bypass the range check in tcf_action_check_ctrlact(), allowing user space to store TC_ACT_C...

CVE-2026-74612 veth: fix skb length accounting after XDP frag adjustment

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

EUVD-2026-64549

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdpbuff. If an XDP program adjusts the fragment area, vethxdprcvskb copies xdpfragssize back to skb-datalen but leaves...

CVE-2026-74612

CVE-2026-74612 is a Linux kernel vulnerability in the veth (virtual Ethernet) driver. When an XDP program adjusts the fragment area, veth_xdp_rcv_skb() updates skb->data_len but leaves skb->len stale, causing skb_headlen() to exceed the actual linear area after a fragment shrink. In the UDP...

PT-2026-79710

In the Linux kernel, the following vulnerability has been resolved: udp: fix potential use-after-free in tunnel segmentation skb udp tunnel segment gets the UDP header before ensuring the tunnel header is in the skb head. If the pull reallocates skb-head, the saved UDP header pointer is no longer...

PT-2026-79700

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf flow table: drop existing skb dst before skb dst set noref Incoming skbs passing through netfilter flowtable offload hooks or XFRM offload path might already carry a ref-counted dst entry assigned during earlier RX ...

PT-2026-79626

In the Linux kernel, the following vulnerability has been resolved: net/sched: act ct: fix sk buff leak when the header checks reject a packet tcf ct handle fragments runs its header sanity checks before handing anything to the defragmentation engine: if family == NFPROTO IPV4 err = tcf ct ipv4 i...

PT-2026-79621

In the Linux kernel, the following vulnerability has been resolved: xdp: reject clones that overrun skb shared info tailroom xdpf clone clones broadcast copies into a single page and sets frame sz to PAGE SIZE. xdp build skb from frame later treats that page like a normal XDP frame and expects th...

PT-2026-79602

In the Linux kernel, the following vulnerability has been resolved: ip6 tunnel: clear skb2-cb in ip6ip6 err ip6ip6 err clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6 send. The clone still carries the outer packet's inet6 skb parm...

PT-2026-79683

In the Linux kernel, the following vulnerability has been resolved: net: usb: ax88179 178a: fix skb leak in ax88179 tx fixup When the interface has NETIF F SG enabled and skb linearize fails in ax88179 tx fixup, the function returns NULL without freeing the skb. usbnet start xmit treats a NULL...

PT-2026-79672

In the Linux kernel, the following vulnerability has been resolved: net/packet: reset the MAC header on the packet-socket transmit path packet parse headers resets the MAC header only for a SOCK RAW frame whose socket did not bind a protocol. A protocol-bound SOCK RAW socket, any SOCK DGRAM frame...

PT-2026-79706

In the Linux kernel, the following vulnerability has been resolved: net/openvswitch: check Ethernet header length in key extract When a packet arrives on an ARPHRD NONE device e.g. TUN, ovs flow key extract trusts the user-provided skb-protocol field: if it is ETH P TEB, the packet is classified ...

PT-2026-79617

In the Linux kernel, the following vulnerability has been resolved: veth: fix skb length accounting after XDP frag adjustment veth exposes non-linear skb fragments through an xdp buff. If an XDP program adjusts the fragment area, veth xdp rcv skb copies xdp frags size back to skb-data len but...

PT-2026-79669

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reallocate update replies for mismatched IDs ovs flow cmd new preallocates the optional reply skb before it takes ovs mutex and before it knows which existing flow will be updated. That is normally fine because...

PT-2026-79670

In the Linux kernel, the following vulnerability has been resolved: net: fix skb length accounting after generic XDP frag adjustment Generic XDP exposes non-linear skb fragments through an xdp buff. If an XDP program adjusts the fragment area, bpf prog run generic xdp copies xdp frags size back t...

PT-2026-79632

In the Linux kernel, the following vulnerability has been resolved: net: devmem: prevent net-iov / page mixing We should either have net iov or page backed frags in a single skb, otherwise it blows up down the stack. Don't allow mixing in zerocopy fill skb from devmem...

CVE-2026-74476

A flaw was found in the veth component of the Linux kernel. This vulnerability occurs when a specially crafted network packet, known as a fraglist skb socket buffer, is processed by the veth driver. An attacker could potentially send such a packet, causing the system to misinterpret fragment...

CVE-2026-74263

A flaw was found in the Linux kernel's Wireless Wide Area Network WWAN t7xx driver. The t7xxportctrltx function, which handles control transmissions, fails to validate the return value of skbclone. An attacker with local access could exploit this by triggering a scenario where skbclone returns a...

CVE-2026-72393

A flaw was found in the Linux kernel's fbnic Ethernet driver. When the fbnictxlso function reallocates a socket buffer skb, it fails to update a cached pointer to shared information. This can lead to a use-after-free vulnerability, where the driver attempts to access memory that has already been...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...