PT-2026-106564

In the Linux kernel, the following vulnerability has been resolved: net/sched: act api: release tail references on DELACTION failure A batched RTM DELACTION request takes a temporary reference on each action before attempting any deletion. tcf action delete clears each processed slot and drops it...

PT-2026-98556

In the Linux kernel, the following vulnerability has been resolved: net/sched: act api: release all action references on NEWACTION failure When a batched RTM NEWACTION request replaces an existing action, tcf idr check alloc takes a temporary reference on it. If a later action fails to initialize...

PT-2026-94426

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description Issues exist in the tcf skbmod act function regarding length calculations and header handling. The function incorrectly assumes the transport header is set when calling skb network heade...

PT-2026-94431

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the act ife component of the network scheduler where the system incorrectly uses skb-dev-hard header len to determine the length of the Ethernet header during...

CVE-2026-82184

The WPLP Cookie Consent WordPress plugin (versions before 4.4.2 ) is vulnerable to an unauthenticated attack due to a lack of authorization and CSRF checks when storing visitor consent state. Because the vulnerable code executes on every front-end page load, an unauthenticated attacker can overwr...

WordPress WPLP Cookie Consent plugin < 4.4.2 - Unauthenticated IAB TCF Consent Option Update vulnerability

Unauthenticated IAB TCF Consent Option Update vulnerability discovered by Alex Spataru in WordPress Plugin WP Cookie Notice for GDPR, CCPA & ePrivacy Consent versions 4.4.2...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-001436)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-001436 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: Fix UAF when resolving a clash KASAN reports the following UAF: BUG: KASAN:...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle

...

The vulnerability of the tcf_connmark_dump() function in the net/sched/act_connmark.c module of the network/sched subsystem of the Linux operating system allows a attacker to access protected information or cause service interruptions.

The vulnerability of the tcfconnmarkdump function in the net/sched/actconnmark.c module of the net/sched/actconnmark subsystem of the Linux operating system is related to the use of an uninitialized resource. Exploiting this vulnerability could allow an attacker to access protected information or...

CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

UBUNTU-CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

CVE-2026-64530

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsapi: Handle TCACTCONSUMED in tcfqeventhandle tcfclassify can return TCACTCONSUMED while the skb is held by the defragmentation engine e.g. actct on out-of-order fragments. When that happens the skb is no longer owne...

CVE-2026-64530

CVE-2026-64530 affects the Linux kernel net/sched subsystem. The root cause is that tcf_qevent_handle() did not properly handle TC_ACT_CONSUMED, causing the skb to be returned to the caller as if classification passed, while the defragmentation engine still owned it. This led to a use-after-free ...

SUSE CVE-2026-53014

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: fix wrong device for macheaderxmit check in tcfblockcastredir In tcfblockcastredir, when iterating block ports to redirect packets to multiple devices, the macheaderxmit flag is queried from the wrong device...

CVE-2026-53014

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: fix wrong device for macheaderxmit check in tcfblockcastredir In tcfblockcastredir, when iterating block ports to redirect packets to multiple devices, the macheaderxmit flag is queried from the wrong device...

CVE-2026-53014 net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: fix wrong device for macheaderxmit check in tcfblockcastredir In tcfblockcastredir, when iterating block ports to redirect packets to multiple devices, the macheaderxmit flag is queried from the wrong device...

CVE-2026-53014 net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir

In the Linux kernel, the following vulnerability has been resolved: net/sched: actmirred: fix wrong device for macheaderxmit check in tcfblockcastredir In tcfblockcastredir, when iterating block ports to redirect packets to multiple devices, the macheaderxmit flag is queried from the wrong device...