CVE-2026-89480 nvme-tcp: reject a read that transferred too few bytes

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

CVE-2026-89480

CVE-2026-89480 affects the NVMe-TCP driver in the Linux kernel. The function nvme_tcp_recv_data() completes a read request once the current C2HData PDU is consumed, but no mechanism compares the total bytes received against the length requested by the command. A malicious or faulty NVMe controlle...

EUVD-2026-76386

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvmetcprecvdata completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for: struct...

Linux Distros Unpatched Vulnerability : CVE-2026-57226

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Debian Linux - suricata - None Ubuntu Linux - detect/filedata: heap buffer overflow in SWF decompression depth handling CVE-2026-57226 Note that Nessus relies o...

PT-2026-90198

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: do not accept C2HData based on blk rq payload bytes alone Commit 25e5cb780e62 "nvme-tcp: fix possible crash in write zeroes processing" established that blk rq payload bytes must not be read without first checking blk r...

PT-2026-90197

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: fix host memory disclosure on R2T for a read command nvme tcp handle r2t does not check the direction of the request the R2T refers to. A malicious controller can send an R2T for a READ and the host will answer it: nvme...

PT-2026-90196

In the Linux kernel, the following vulnerability has been resolved: nvme-tcp: reject a read that transferred too few bytes nvme tcp recv data completes a request once the current C2HData PDU has been consumed. Nothing compares the total bytes received against the length the command asked for:...

kernel: Revert "net/smc: Introduce TCP ULP support"

A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...

kernel: tcp: call sk_data_ready() after listener migration

A flaw was found in the Linux kernel's TCP networking subsystem. When an established network connection is migrated between listener sockets within the same SOREUSEPORT group, applications waiting for new connections may not be properly notified. This can cause poll, epollwait, and blocking accep...

kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...

undici: undici: Denial of Service via WebSocketStream unclean close

A flaw was found in undici's experimental WebSocketStream client. A remote attacker, operating as an untrusted server, can trigger a Denial of Service DoS by closing the TCP connection without a proper WebSocket close handshake. This action causes an unhandled error in the client, leading to the...

The vulnerability of the `tcp_ao_delete_key()` function in the `net/ipv4/tcp_ao.c` module, which is part of the IPv4 protocol implementation in Linux kernel, allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tcpaodeletekey function in the net/ipv4/tcpao.c module, part of the IPv4 protocol implementation in Linux kernel, relates to the dereferencing of a pointer with an expired validity period. Exploiting this vulnerability could allow an attacker to compromise the...

CVE-2026-69793

Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a network...

CVE-2026-69761

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network...

CVE-2026-69757

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network...

CVE-2026-69588

Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network...

CVE-2026-69404

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

CVE-2026-69385

Concurrent execution using shared resource with improper synchronization 'race condition' in Windows TCP/IP allows an authorized attacker to elevate privileges locally...

EUVD-2026-73612

Use after free in Windows TCP/IP allows an authorized attacker to elevate privileges over a network...

CVE-2026-69761

A use-after-free vulnerability in Windows TCP/IP allows an authorized attacker to elevate privileges over a network . The CVSS 3.1 score is 7.1 (HIGH) , with a vector of AV:N/AC:H/PR:L/UI:R, meaning exploitation requires network access , high attack complexity , low existing privileges , and user...