CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

CVE-2026-64035

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

EUVD-2026-45608

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64025

CVE-2026-64025 affects Linux kernel BPF plumbing where a TLS RX context could cause a use-after-free-like condition in data-path when a socket is inserted into a sockmap before TLS RX is configured. The issue arises because sk_psock_verdict_data_ready() does not guard against TLS RX ownership of ...

CVE-2026-64025 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...

CVE-2026-64024

CVE-2026-64024 concerns a Linux kernel issue where a per-CPU tcp_tw_isn leak could enable ISN prediction. The root cause was that TIME_WAIT-derived ISNs were stored in a per-CPU variable and could be consumed by a subsequent SYN if a packet was dropped along several paths (e.g., min_ttl/min_hop, ...

CVE-2026-63871

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

CVE-2026-64011

The CVE-2026-64011 issue affects the Linux kernel NFC LLCP path: llcp_sock_release() unlinks a socket from the local sockets list unconditionally, but if the socket is still in the connecting state it resides on the connecting list. The fix adds a state check and unlinks from the correct list, ad...

EUVD-2026-45583

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64011

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

CVE-2026-64010

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

CVE-2026-64011 nfc: llcp: Fix use-after-free in llcp_sock_release()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

EUVD-2026-45584

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64011 nfc: llcp: Fix use-after-free in llcp_sock_release()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

CVE-2026-64007

The CVE concerns the Linux kernel netfilter synproxy path. In synproxy_tstamp_adjust, the code rewrites the TCP timestamp in place and then updates the TCP checksum via inet_proto_csum_replace4() on a caller-supplied tcphdr pointer. Between retrieving the pointer (via skb_header_pointer) and use,...

CVE-2026-64007

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...

CVE-2026-64007 netfilter: synproxy: refresh tcphdr after skb_ensure_writable

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skbensurewritable synproxytstampadjust rewrites the TCP timestamp option in place and then patches the TCP checksum via inetprotocsumreplace4 on the caller-supplied tcphdr pointer. Both...