CVE-2026-64113

In the Linux kernel, CVE-2026-64113 fixes a use-after-free in ixgbevf when pruning VEPA multicast frames. The function ixgbevf_clean_rx_irq() frees an skb (dev_kfree_skb_irq) and continues, but the skb pointer is kept outside the loop. On the next iteration, the code may dereference freed memory ...

EUVD-2026-45795

In the Linux kernel, the following vulnerability has been resolved: igc: fix potential skb leak in igcfpexmitsmdframe When igcfpeinittxdescriptor fails, no one takes care of an allocated skb, leaking it. 1 Use devkfreeskbany on failure. Tested on an I226 adapter with the following command, while...

CVE-2026-64110

Summary (CVE-2026-64110) : Several sources describe a memory-leak vulnerability in the Linux kernel igc driver (Intel Gigabit Ethernet). The root cause is that when igc_fpe_init_tx_descriptor() fails, an allocated skb is not freed, causing a potential memory exhaustion condition. The fix is to ca...

CVE-2026-64076

The CVE concerns the Linux kernel netfilter/bridge eb_tables initialization, specifically a close module init race. Technical details across the documents describe a race condition where sockopts may be exposed globally after nf_register_sockopt() completes, implying that sockopt registration ord...

CVE-2026-64045 ovpn: tcp - use cached peer pointer in ovpn_tcp_close()

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...

CVE-2026-64045 ovpn: tcp - use cached peer pointer in ovpn_tcp_close()

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...

EUVD-2026-45618

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...

CVE-2026-64044

In the Linux kernel, the following vulnerability has been resolved: ovpn: respect peer refcount in CMDNEWPEER error path ovpnnlpeernewdoit's error path calls ovpnpeerrelease directly rather than ovpnpeerput, bypassing the kref. The accompanying comment "peer was not yet hashed, thus it is not use...

EUVD-2026-45608

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64035

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

CVE-2026-64025 bpf, skmsg: fix verdict sk_data_ready racing with ktls rx

In the Linux kernel, the following vulnerability has been resolved: bpf, skmsg: fix verdict skdataready racing with ktls rx skpsockstrpdataready already checks tlsswhasctxrx and defers to psock-saveddataready when a TLS RX context is present, avoiding a conflict with the TLS strparser's ownership...

CVE-2026-64025

CVE-2026-64025 affects Linux kernel BPF plumbing where a TLS RX context could cause a use-after-free-like condition in data-path when a socket is inserted into a sockmap before TLS RX is configured. The issue arises because sk_psock_verdict_data_ready() does not guard against TLS RX ownership of ...

CVE-2026-64024

CVE-2026-64024 concerns a Linux kernel issue where a per-CPU tcp_tw_isn leak could enable ISN prediction. The root cause was that TIME_WAIT-derived ISNs were stored in a per-CPU variable and could be consumed by a subsequent SYN if a packet was dropped along several paths (e.g., min_ttl/min_hop, ...

CVE-2026-63871

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Fix data-race on isopi fields in hcigetroute calls isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync call hcigetroute using isopisk-dst, isopisk-src, and isopisk-srctype without holding locksock. Thes...

CVE-2026-64010 nfc: llcp: Fix use-after-free race in nfc_llcp_recv_cc()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64011 nfc: llcp: Fix use-after-free in llcp_sock_release()

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

EUVD-2026-45583

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...

CVE-2026-64010

CVE-2026-64010 involves a use-after-free in the Linux NFC LLCP stack. The race occurs when nfc_llcp_recv_cc() moves a socket from the connecting_sockets list to the sockets list without holding the socket lock, risking linking a freed socket if llcp_sock_release() runs concurrently. The mitigatio...

CVE-2026-64011

The CVE-2026-64011 issue affects the Linux kernel NFC LLCP path: llcp_sock_release() unlinks a socket from the local sockets list unconditionally, but if the socket is still in the connecting state it resides on the connecting list. The fix adds a state check and unlinks from the correct list, ad...

CVE-2026-64010

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free race in nfcllcprecvcc A race condition exists in the NFC LLCP connection state machine where the connection acceptance packet CC can be processed concurrently with socket release. This can lead to a...