404080 matches found
CVE-2026-74727 ovpn: skip rehash for peers already removed from by_id
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...
EUVD-2026-64414
In the Linux kernel, the following vulnerability has been resolved: ovpn: skip rehash for peers already removed from byid ovpnnlpeersetdoit resolves the target peer via ovpnpeergetbyid before taking ovpn-lock. In the window between the lookup which only takes a refcount and the subsequent...
CVE-2026-74720 bpf: Preserve pointer state for commuted arithmetic
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...
CVE-2026-74720
CVE-2026-74720 affects the Linux kernel BPF verifier , specifically the adjust_ptr_min_max_vals() function. When handling the commuted arithmetic operation scalar += pointer, the destination register inherits pointer state from the source pointer by copying only selected fields. This is fragile b...
EUVD-2026-64407
In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer state for commuted arithmetic When scalar += pointer is handled in adjustptrminmaxvals, the destination register inherits the pointer state from the source pointer. Copying only selected fields is fragile...
CVE-2026-74713 vhost_iotlb: bound map allocation in add_range
In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...
EUVD-2026-64400
In the Linux kernel, the following vulnerability has been resolved: vhostiotlb: bound map allocation in addrange vhostiotlbaddrangectx only retires an old entry when the table has a non-zero limit, has exactly reached that limit and has VHOSTIOTLBFLAGRETIRE set. Non-retiring tables can keep...
CVE-2026-74713
CVE-2026-74713 affects the Linux kernel vhost_iotlb subsystem. The root cause is that vhost_iotlb_add_range_ctx() only retires an old entry when the table has a non-zero limit, has exactly reached that limit, and has VHOST_IOTLB_FLAG_RETIRE set. Non-retiring tables can keep allocating entries aft...
CVE-2026-74702
CVE-2026-74702 affects the Linux kernel vhost-scsi module. The root cause is that vhost_scsi_set_features() accepts changes to virtio feature bits (specifically VIRTIO_SCSI_F_T10_PI) after the endpoint is already active via VHOST_SCSI_SET_ENDPOINT. This leaves the prot_sgl scatterlist array as NU...
CVE-2026-74702 vhost-scsi: reject feature changes after endpoint
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...
EUVD-2026-64389
In the Linux kernel, the following vulnerability has been resolved: vhost-scsi: reject feature changes after endpoint vhostscsisetupvqcmds runs from VHOSTSCSISETENDPOINT and allocates each command's protection scatterlist array protsgl according to the acknowledged VIRTIOSCSIFT10PI bit. The comma...
CVE-2026-74700
CVE-2026-74700 is a use-after-free vulnerability in the Linux kernel's net/sched/cls_api subsystem (traffic control classifier API). The root cause is a race condition in tc_new_tfilter where a tcf_proto object can be briefly referenced by an unrelated unlocked classifier request, causing tp->...
EUVD-2026-64387
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74700 net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers
In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Always acquire rtnllock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tcnewtfilter where a tcfproto can be found and briefly referenced by a totally...
CVE-2026-74677
CVE-2026-74677 is a use-after-free in the Linux kernel's ipheth USB network driver. The root cause is that ipheth_sndbulk_callback() re-arms the carrier_work delayed work on any non-zero URB status without checking whether the interface is still up. After ipheth_close() drains the work, a late UR...
EUVD-2026-64364
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...
CVE-2026-74677 net: usb: ipheth: fix carrier_work UAF on disconnect
In the Linux kernel, the following vulnerability has been resolved: net: usb: ipheth: fix carrierwork UAF on disconnect iphethsndbulkcallback re-arms the carrier-check work on any non-zero URB status: else scheduledelayedwork&dev-carrierwork, 0; Nothing ties that to the interface being up, so the...
CVE-2026-74674 mm: fix incorrect flush address in direct page table reclaim
In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...
EUVD-2026-64361
In the Linux kernel, the following vulnerability has been resolved: mm: fix incorrect flush address in direct page table reclaim When zappterange reclaims a page table, it does: ptefreetlbtlb, pmdpgtablepmdval, addr; and this is unconditionally wrong: if this code executes, addr always points one...
CVE-2026-74674
CVE-2026-74674 is a Linux kernel vulnerability in the memory management (mm) subsystem, specifically in the zap_pte_range function. When reclaiming a page table, the kernel calls pte_free_tlb with an addr parameter that always points one past the end of the range covered by the table. This causes...