CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72383

In the Linux kernel SCTP subsystem, CVE-2026-72383 describes a race in sctp_free_addr_wq() where addr_wq_timer could be re-entered after addr_wq_lock is held, allowing a sctp_addr_wq_timeout_handler() to access freed memory (use-after-free). The vulnerability is mitigated by calling timer_shutdow...

CVE-2026-72383 sctp: fix addr_wq_timer race in sctp_free_addr_wq()

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

EUVD-2026-59282

In the Linux kernel, the following vulnerability has been resolved: sctp: fix addrwqtimer race in sctpfreeaddrwq sctpfreeaddrwq previously removed addrwqtimer using timerdelete while holding addrwqlock. However, timerdelete does not guarantee that a currently running timer handler has completed...

CVE-2026-72342 net/mlx5e: Fix HV VHCA stats agent registration race

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: Fix HV VHCA stats agent registration race mlx5ehvvhcastatscreate registers the stats agent through mlx5hvvhcaagentcreate. The helper publishes the agent in hvvhca-agentstype under agentslock and immediately schedules a...

CVE-2026-72342

The CVE-2026-72342 issue affects the Linux kernel’s net/mlx5e HV VHCA stats path. The race occurs in mlx5e_hv_vhca_stats_create() when publishing the stats agent via mlx5_hv_vhca_agent_create(): the agent is published and a delayed invalidation is scheduled before priv->stats_agent.agent and p...

CVE-2026-72323

CVE-2026-72323 — Linux kernel igmp UAF vulnerability : A race between device teardown (inetdev_destroy) and IGMP query processing (igmp_rcv) can cause a Use-After-Free in the IGMP timer callback when the timer is re-armed. The in_device memory is freed via RCU after its refcount reaches 0, but ig...

EUVD-2026-59222

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72323 ipv4: igmp: Fix potential UAF in igmp_gq_start_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential UAF in igmpgqstarttimer A race condition exists between device teardown inetdevdestroy and incoming IGMP query processing igmprcv, leading to a Use-After-Free in the IGMP timer callback. During device...

CVE-2026-72321 ipv4: igmp: Fix potential memory leaks in igmp_mod_timer() and igmp_stop_timer()

In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential memory leaks in igmpmodtimer and igmpstoptimer When a timer is deleted and not re-armed in igmpmodtimer, or stopped in igmpstoptimer, the code currently decrements the reference counter of the multicast...

CVE-2026-72126

The CVE concerns a Linux kernel race in the isotp path of CAN networking. The fix makes isotp_release() always call synchronize_rcu() before cancelling RX timers, regardless of so->bound, addressing a scenario where NETDEV_UNREGISTER could allow a use-after-free of a timer callback if an in-fl...

CVE-2026-72126 can: isotp: use unconditional synchronize_rcu() in isotp_release()

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

CVE-2026-72126 can: isotp: use unconditional synchronize_rcu() in isotp_release()

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

EUVD-2026-58884

In the Linux kernel, the following vulnerability has been resolved: can: isotp: use unconditional synchronizercu in isotprelease isotpnotify unregisters the RCU CAN filters via canrxunregister and clears so-bound without waiting for a grace period. isotprelease uses so-bound to decide whether it...

CVE-2026-72123 can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF

In the Linux kernel, the following vulnerability has been resolved: can: bcm: defer rxop deallocation to workqueue to fix thrtimer UAF Commit f1b4e32aca08 "can: bcm: use callrcu instead of costly synchronizercu" replaced synchronizercu in bcmdeleterxop with callrcu and introduced the RXNOAUTOTIME...

EUVD-2026-58879

In the Linux kernel, the following vulnerability has been resolved: can: bcm: add locking when updating filter and timer values KCSAN detected a simultaneous access to timer values that can be overwritten in bcmrxsetup when updating timer and filter content while bcmrxhandler, bcmrxtimeouthandler...

CVE-2026-72116

The CVE-2026-72116 entry describes a Linux kernel issue in the CAN networking path (bcm) where stale RX/TX operation references could occur after device removal. RX: an RX_SETUP update could skip can_rx_register() if NETDEV_UNREGISTER occurred, leaving rx_ops with ifindex=0 and not re-enabling fr...

CVE-2026-72115 can: bcm: track a single source interface for ANYDEV timeout/throttle ops

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

CVE-2026-72115 can: bcm: track a single source interface for ANYDEV timeout/throttle ops

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...

EUVD-2026-59073

In the Linux kernel, the following vulnerability has been resolved: can: bcm: track a single source interface for ANYDEV timeout/throttle ops An ANYDEV rx op ifindex == 0 with an active RX timeout and/or throttle timer has no defined semantics when matching frames arrive from several interfaces:...