kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-50248

A flaw in Unbound allows a remote attacker to replace an authenticated or Response Policy Zone RPZ by spoofing DNS records for configured primary hostnames. This enables the attacker to impersonate the primary server, leading to DNS cache poisoning or traffic redirection. Mitigation Configure...

PT-2026-77239

Name of the Vulnerable Software and Affected Versions submariner-operator affected versions not specified Description A flaw in the submariner-operator component involves the submariner-k8s-broker-cluster Role assigned to joined clusters, which possesses excessive permissions. This allows a...

CVE-2026-65329

CVE-2026-65329 affects the Telephony framework on iOS 26.6.1/iPadOS 26.6.1 (iPhone 11+), where an authentication issue in IPSec state management allowed a privileged-network-position attacker to bypass IPSec authentication and intercept network traffic; fixed via improved state management. No exp...

CVE-2026-65329

An authentication issue was addressed with improved state management. This issue is fixed in iOS 26.6.1 and iPadOS 26.6.1. An attacker in a privileged network position may be able to bypass IPSec authentication and intercept network traffic...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-72036

A flaw was found in the Linux kernel's schmultiq component, which handles network packet scheduling. This vulnerability occurs when a non-work-conserving child queue is improperly handled after a packet has been temporarily stored. This can lead to a desynchronization of network packet queues and...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

kernel: net: sched: UAF via missing handler for TC_ACT_CONSUMED in tcf_qevent_handle

A flaw was found in the Linux kernel's traffic control TC classifier application programming interface API. The tcfqeventhandle function does not properly handle a consumed socket buffer skb when it is processed by the defragmentation engine. This can lead to a Use-After-Free UAF vulnerability,...

CVE-2026-74802

SiYuan versions before 3.7.4 contain a cross-site WebSocket hijacking vulnerability in the admin-only /ws/network/proxy endpoint that explicitly disables origin validation by setting CheckOrigin to unconditionally return true. Attackers can craft malicious webpages that establish WebSocket...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100548)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100548 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsfw: fix NULL dereference of old filters before change Like pointed out by Sashiko 1...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100325)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100325 advisory. In the Linux kernel, the following vulnerability has been resolved: net: sched: clsapi: fix tcchainfillnode to initialize tcminfo to zero to prevent an info-leak Whe...

CVE-2026-72344

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5laggetdevseq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, skip th...

CVE-2026-72297

In the Linux kernel, the following vulnerability has been resolved: net: atm: reject out-of-range traffic classes in QoS validation Reject ATM traffic classes above ATMANYCLASS in checktp. SOATMQOS stores the supplied QoS after checkqos succeeds, so accepting larger values leaves invalid...

EUVD-2026-59529

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsbpf: prevent unbounded recursion in offload rollback Quan Sun reported 1 a stack overflow in clsbpfoffloadcmd. Reproducer on netdevsim: add a skipsw clsbpf filter, set the bpftcaccept debugfs knob to 0, then tc filt...

CVE-2026-74284 net/sched: sch_hfsc: Don't make class passive twice

In the Linux kernel, the following vulnerability has been resolved: net/sched: schhfsc: Don't make class passive twice updatevf is called from two places for the same class during a single dequeue when the class's child qdisc e.g. codel/fqcodel drops its last packets while dequeuing: 1. The child...

CVE-2026-72344 net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5laggetdevseq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, skip th...

CVE-2026-72344 net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable

In the Linux kernel, the following vulnerability has been resolved: net/mlx5e: TC, skip peer flow cleanup when LAG seq is unavailable mlx5laggetdevseq will return error when the peer isn't in the LAG or when no device is marked as master. Result bad memory access and kernel crash1. Hence, skip th...