DEBIAN-CVE-2026-90159

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

EUVD-2026-81752

In the Linux kernel, the following vulnerability has been resolved: bpf: Disallow bpfg,setsockopt in cgroup UNIX getname hooks bpfsetsockopt and bpfgetsockopt call sockownedbyme for full sockets, so these helpers expect the socket lock to be held. BPFCGROUPUNIXGETPEERNAME and...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: RFCOMM: Fixed a possible deadlock in rfcommskstatechange. rfcommskstatechange attempts to use socklock, so it should never be called with it locked. However, rfcommsockioctl always attempts to lock it, causing the...

Astra Linux – Vulnerability in Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: Bluetooth: afbluetooth: Fixed deadlock issues Attempting to use socklock on .recvmsg may cause a deadlock as shown below. Therefore, instead of using socksock, use skreceivequeue.lock on btsockioctl to avoid UAF: INFO: Task...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - rxrpc: Fixed the locking mechanism in rxrpc’s sendmsg function. - Three bugs were fixed in the implementation of rxrpc’s sendmsg function: 1 The rxrpcnewclientcall function should release the socket lock when returning an...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: l2tp: All race conditions in l2tptunnelregister have been fixed. The code within l2tptunnelregister is problematic in several ways: 1. It modifies the tunnel socket after it is published. 2. It calls setupudptunnelsock on an...

kernel: sctp: fix race between sctp_wait_for_connect and peeloff

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

UBUNTU-CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

EUVD-2026-76305

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80982

CVE-2026-80982 is a use-after-free in the Linux kernel's SMC (Shared Memory Communications) network protocol (net/smc). The root cause is a race condition in smc_rx_pipe_buf_release(): it checks sk_state before acquiring the socket lock, so a concurrent smc_conn_free() can release the connection ...

kernel: sctp: fix race between sctp_wait_for_connect and peeloff

A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A race condition exists in the sctpwaitforconnect function, where a socket lock is temporarily released and re-acquired. During this brief period, another process can move the SCTP association to a...

CVE-2026-85443

MOOS core-moos through 10.4.0 has a denial of service vulnerability in MOOSCommServer::ListenLoop(). The accept thread performs a blocking receive without timeout during the wire-protocol handshake. An unauthenticated network attacker can open a TCP connection to the MOOSDB port and send no data,...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100113)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100113 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires th...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100566)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100566 advisory. In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires th...

CVE-2026-74535

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: avoid deadlocks in isosocktimeout isosocktimeout takes locksock, so sync disabling the timer while holding that lock may deadlock. isosocktimeout may also run concurrently with isoconndel, which leads to UAF Task ...

EUVD-2026-59731

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: lock sk in isoconnectind Accessing isopisk-conn requires locksock, which is not taken in the "ev3" part of isoconnectind. It may also be NULL if socket has transitioned away from the LISTEN/CONNECT states before...

CVE-2026-74537

The CVE-2026-74537 entry concerns the Linux kernel Bluetooth ISO path. A use-after-free could occur when dereferencing conn->sk in iso_conn_ready because the socket was accessed without holding a lock or a refcount. The fix adds a socket refcount in iso_conn_ready and rechecks socket validity ...

CVE-2026-74490

In the Linux kernel, the following vulnerability has been resolved: tipc: avoid use-after-free in poll trace queue dumps TIPC socket tracepoints dump queue state through tipcskdump. Most queue-dump callsites already serialize that walk under the socket lock or sk-sklock.slock, but tipcpoll calls...

CVE-2026-74436

In the Linux kernel, the following vulnerability has been resolved: rxrpc: serialize kernel accept preallocation with socket teardown rxrpckernelchargeaccept reads rx-backlog without any socket/backlog synchronization and passes that raw pointer into rxrpcservicepreallocone. A concurrent...