EUVD-2026-55548

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68162

CVE-2026-68162 is a Linux kernel SCTP vulnerability (local) where a Use-After-Free can occur during netns teardown due to an auth_enable sysctl window. The bug stems from SCTP’s per-net sysctl state being registered before the control socket is fully established and remaining writable after inet_...

CVE-2026-68162 sctp: avoid auth_enable sysctl UAF during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68161

Summary of CVE-2026-68161 : In the Linux kernel, SCTP UDP tunnel sockets created per-net SCTP UDP port (net.sctp.udp_port) are not stopped when a network namespace (netns) is torn down, potentially leaving sockets installed during teardown. The root cause is that the netns exit path does not stop...

CVE-2026-68161 sctp: close UDP tunnel sockets during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

CVE-2026-68161 sctp: close UDP tunnel sockets during netns teardown

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

EUVD-2026-55539

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

CVE-2026-68153

CVE-2026-68153 (libceph - Linux kernel) : A race during client teardown allows a concurrent read of the monmap debugfs file to access freed memory, causing a use-after-free. The fix drains and removes per-client debugfs files before stopping the OSD/monitor clients, preventing new accesses during...

CVE-2026-68153 libceph: remove debugfs files before client teardown

In the Linux kernel, the following vulnerability has been resolved: libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent read of the monmap debugfs file can enter monmapshow after cephmoncst...

CVE-2026-68162: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the per-net SCTP state from ctl-data, so an already opened sysctl file ca...

CVE-2026-68290: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: unregister sysctl before tearing down listen socket rdstcpexitnet frees the per-netns RDS TCP listen socket via rdstcpkillsock before unregistering the per-netns sysctl table. Since rdstcpskbufhandler derives the netns...

Linux Distros Unpatched Vulnerability : CVE-2026-68162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: avoid authenable sysctl UAF during netns teardown procsctpdoauth updates the SCTP control socket after changing net.sctp.authenable. The handler gets the...

Linux Distros Unpatched Vulnerability : CVE-2026-68153

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libceph: remove debugfs files before client teardown cephdestroyclient tears down the monitor client before removing the per-client debugfs files. A concurrent...

PT-2026-69561

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the SCTP implementation where the network namespace netns exit path fails to stop per-net SCTP UDP tunneling sockets. This occurs when net.sctp.udp port is set, allowi...

CVE-2026-68161: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

PT-2026-69537

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the x25 kill by neigh function. The function iterates through the global X.25 socket list to find sockets linked to a terminating neighbour. While x25 li...

Linux Distros Unpatched Vulnerability : CVE-2026-68161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restart...

usb: gadget: udc: bdc: free IRQ and drain func_wake_notify before teardown

...

SUSE CVE-2026-64583

In the Linux kernel, the following vulnerability has been resolved: usb: gadget: udc: bdc: free IRQ and drain funcwakenotify before teardown The Broadcom BDC UDC driver registers its IRQ handler with devmrequestirq in bdcudcinit, so the IRQ is released by devm only after bdcremove returns. devm...

SUSE CVE-2026-64585

In the Linux kernel, the following vulnerability has been resolved: can: esdusb: kill anchored URBs before freeing netdevs esdusbdisconnect frees each CAN netdev with freecandev inside its per-netdev loop and only calls unlinkallurbsdev afterwards. The per-netdev private data struct esdusbnetpriv...