CVE-2026-68397 net/iucv: take a reference on the socket found in afiucv_hs_rcv()

In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucvhsrcv afiucvhsrcv looks up the destination socket under iucvsklist.lock, drops the lock, and then passes the socket to the afiucvhscallback handlers without holding a...

DEBIAN-CVE-2026-31411

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigdsend Reproducer available at 1. The ATM send path sendmsg - vccsendmsg - sigdsend reads the vcc pointer from msg-vcc and uses it directly without any validation. This...

CVE-2026-31411 net: atm: fix crash due to unvalidated vcc pointer in sigd_send()

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigdsend Reproducer available at 1. The ATM send path sendmsg - vccsendmsg - sigdsend reads the vcc pointer from msg-vcc and uses it directly without any validation. This...

CVE-2026-31411

In the Linux kernel, the following vulnerability has been resolved: net: atm: fix crash due to unvalidated vcc pointer in sigdsend Reproducer available at 1. The ATM send path sendmsg - vccsendmsg - sigdsend reads the vcc pointer from msg-vcc and uses it directly without any validation. This...

CVE-2026-31408 Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: SCO: Fix use-after-free in scorecvframe due to missing sockhold scorecvframe reads conn-sk under scoconnlock but immediately releases the lock without holding a reference to the socket. A concurrent close can free the...

SUSE CVE-2025-71086

In the Linux kernel, the following vulnerability has been resolved: net: rose: fix invalid array index in rosekillbydevice rosekillbydevice collects sockets into a local array and then iterates over them to disconnect sockets bound to a device being brought down. The loop mistakenly indexes...

CVE-2025-71086

Technical details for CVE-2025-71086 are not publicly available in the provided documents. Monitor for updates from official advisories; the initial description mentions a Linux kernel fix in net rose_kill_by_device but no product/version specifics are provided here.

CVE-2022-48911 netfilter: nf_queue: fix possible use-after-free

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: fix possible use-after-free Eric Dumazet says: The sockhold side seems suspect, because there is no guarantee that skrefcnt is not already 0. On failure, we cannot queue the packet and need to indicate an erro...

CVE-2022-48911 netfilter: nf_queue: fix possible use-after-free

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfqueue: fix possible use-after-free Eric Dumazet says: The sockhold side seems suspect, because there is no guarantee that skrefcnt is not already 0. On failure, we cannot queue the packet and need to indicate an erro...

CVE-2024-41006

In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nrheartbeatexpiry syzbot reported a memory leak in nrcreate 0. Commit 409db27e3a2e "netrom: Fix use-after-free of a listening socket." added sockhold to the nrheartbeatexpiry function, where a a socke...

CVE-2024-41006 netrom: Fix a memory leak in nr_heartbeat_expiry()

In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nrheartbeatexpiry syzbot reported a memory leak in nrcreate 0. Commit 409db27e3a2e "netrom: Fix use-after-free of a listening socket." added sockhold to the nrheartbeatexpiry function, where a a socke...

CVE-2024-41006 netrom: Fix a memory leak in nr_heartbeat_expiry()

In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nrheartbeatexpiry syzbot reported a memory leak in nrcreate 0. Commit 409db27e3a2e "netrom: Fix use-after-free of a listening socket." added sockhold to the nrheartbeatexpiry function, where a a socke...

CVE-2024-41006

In the Linux kernel, the following vulnerability has been resolved: netrom: Fix a memory leak in nrheartbeatexpiry syzbot reported a memory leak in nrcreate 0. Commit 409db27e3a2e "netrom: Fix use-after-free of a listening socket." added sockhold to the nrheartbeatexpiry function, where a a socke...

CVE-2024-36904

In the Linux kernel, the following vulnerability has been resolved: tcp: Use refcountincnotzero in tcptwskunique. Anderson Nascimento reported a use-after-free splat in tcptwskunique with nice analysis. Since commit ec94c2696f0b "tcp/dccp: avoid one atomic operation for timewait hashdance",...