2216 matches found
CVE-2026-74692
A flaw was found in the Linux kernel's net/smc component. A time-of-check to time-of-use TOCTOU race condition allows a remote attacker to exploit a window where the listener's state is checked without proper locking. By opening TCP connections while the server is closing, an attacker can cause a...
SUSE CVE-2026-74692
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74707
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
CVE-2026-74692
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74707
CVE-2026-74707 affects the Linux kernel AF_XDP zero-copy TX path. The root cause is a TOCTOU (time-of-check to time-of-use) race : TX metadata is validated when obtaining the descriptor context, but read again later when preparing the hardware request. User space can modify the metadata between t...
CVE-2026-74707 xsk: validate metadata when processing requests
In the Linux kernel, the following vulnerability has been resolved: xsk: validate metadata when processing requests The zero-copy path validates TX metadata while obtaining the descriptor context, then reads it again later when preparing the hardware request. User space can change the metadata...
CVE-2026-74692 net/smc: fix TOCTOU race between smc_listen_out() and listener close
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74692 net/smc: fix TOCTOU race between smc_listen_out() and listener close
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
CVE-2026-74692
CVE-2026-74692 is a TOCTOU race condition in the Linux kernel's net/smc subsystem. The function smc_listen_out() reads sk_state without holding the listener lock, then acquires lock_sock_nested() only after the check passes. This window allows smc_close_active() to transition the listener to SMC_...
EUVD-2026-64379
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only after the check passes. This opens a window where smccloseactive can...
PT-2026-79697
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc listen out and listener close smc listen out reads lsmc-sk.sk state without the listener lock, then acquires lock sock nested only after the check passes. This opens a window where smc close...
PT-2026-79720
In the Linux kernel, the following vulnerability has been resolved: bpf: Fix netns reference imbalance in conntrack kfuncs The opts argument of the BPF conntrack kfuncs can point to a shared map value. bpf nf ct lookup and bpf nf ct alloc entry read opts-netns id separately when acquiring and...
Linux Distros Unpatched Vulnerability : CVE-2026-74692
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/smc: fix TOCTOU race between smclistenout and listener close smclistenout reads lsmc-sk.skstate without the listener lock, then acquires locksocknested only...
EUVD-2026-63995
In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...
CVE-2026-49114 ONNX symlink-following and path-traversal arbitrary file write
In ONNX before 1.21.0, the 'saveexternaldata' function builds the external-data file path from the model's externaldata location field and opens it for writing without 'ONOFOLLOW/OEXCL', after a non-atomic 'os.path.isfile' check. A local attacker with write access to the directory where a victim...
CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...
CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...
CVE-2026-62941 Incus: Cross-project instance copy bypasses target project restrictions via TOCTOU in config merge
Incus is a system container and virtual machine manager. Prior to version 7.3.0, when copying an instance across projects, the project restriction check AllowInstanceCreation runs BEFORE the source instance's configuration is merged into the request. Dangerous configuration keys including...
CVE-2026-74546
A flaw was found in the Linux kernel's hwmon hardware monitoring subsystem, specifically within the adt7470 driver. A local attacker could exploit a time-of-check to time-of-use TOCTOU race condition. If fan data becomes zero between a validation check and a conversion operation, it can lead to a...