CVE-2026-63821

In the Linux kernel, the wifi driver stack for rtw88/USB fixed memory leaks when USB write submissions fail. Specifically, rtw_usb_write_port() failures in rtw_usb_write_data() and rtw_usb_tx_agg_skb() could leave allocated skbs and a txcb/aggregated skbs unfreed due to a missing completion callb...

CVE-2026-63821 wifi: rtw88: usb: fix memory leaks on USB write failures

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: usb: fix memory leaks on USB write failures When rtwusbwriteport fails to submit a USB Request Block URB e.g., due to device disconnect or ENOMEM, the completion callback is never executed. Currently, the driver...

PT-2026-61263

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Bluetooth ISO implementation. The iso recv frame function reads the conn-sk pointer while holding the iso conn lock but releases the lock before...

PT-2026-61307

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A kernel paging request crash occurs in the can rx unregister function within net/can/af can.c when a virtual CAN device vxcan is enslaved to a bonding master. This happens because the...

PT-2026-61243

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the bpf msg push data function within the sockmap component of the BPF Berkeley Packet Filter subsystem. When data is inserted into the middle of a scatterlist entry,...

PT-2026-61494

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An inconsistent lock state exists in the networking receive path when handling PEP pipes. When an inbound socket buffer skb targets an existing PEP pipe, the pep do rcv function forwards...

PT-2026-61426

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A Use-After-Free UAF issue exists in the af unix module. The unix stream data wait function calls skb peek tail on the sk-sk receive queue without holding a lock to prevent Socket Buffer...

PT-2026-61262

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the Bluetooth ISO implementation where iso sock close calls iso sock clear timer before acquiring the socket lock. This allows iso sock clear timer to read the...

PT-2026-61328

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the Logical Link Control Protocol LLCP component of the NFC subsystem. The llcp sock release function unconditionally unlinks the socket from the local...

PT-2026-61300

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A packet loop occurs in the netem Network Emulator module when the duplicate feature is enabled. When netem duplicates a packet, it re-enqueues the copy at the root qdisc Queueing...

Linux Distros Unpatched Vulnerability : CVE-2026-63831

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mac802154: llsec: add skbcowdata before in-place crypto llsecdoencryptunauth, llsecdoencryptauth, llsecdodecryptunauth, and llsecdodecryptauth all perform...

PT-2026-61144

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in AppArmor where the sendmsg and sendto functions, when used with the MSG FASTOPEN flag, combine the actions of connect2 and write2 to open a connection during the SYN...

PT-2026-61362

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the ovpn tcp close function. The function loads the ovpn socket using rcu dereference sk user data under an RCU read lock, caches the peer pointer, and then...

PT-2026-61324

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter synproxy component where the synproxy tstamp adjust function fails to refresh the TCP header pointer after calling skb ensure writable. When skb ensure...

PT-2026-61264

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds read exists in the Bluetooth HIDP component. The hidp input report function processes keyboard and mouse payload data from an skb socket buffer without verifying if...

PT-2026-61327

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the NFC LLCP connection state machine. The issue occurs when a connection acceptance packet CC is processed concurrently with a socket release, potentially...

PT-2026-61239

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 extension header handling where the ip6 parse tlv function caches the network header pointer in nh while processing Type-Length-Value TLV structures. When ipv...

PT-2026-61288

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists between the sctp wait for connect function and the peeloff process. The sctp wait for connect function releases and subsequently re-acquires the socket lock while...

PT-2026-61321

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the net/iucv component when recvmsg is called simultaneously with getsockoptSO MSGSIZE. An AF IUCV HIPER user can trigger a NULL pointer dereference because th...

PT-2026-61188

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A data-race exists in the Bluetooth ISO implementation. The functions iso connect bis, iso connect cis, iso listen bis, and iso conn big sync call hci get route using the dst, src, and s...