PT-2026-94438

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds DMA read exists in the TX path of the Bluetooth btmtksdio driver. The btmtksdio tx packet function rounds the transfer size up to the SDIO block size of 256 bytes while...

EUVD-2026-68744

netipv6sendns in subsys/net/ip/ipv6nbr.c allocates a transmit netpkt for a Neighbor Solicitation. When it is called with a data packet pending on an unresolved neighbor and that neighbor's pendingqueue is already non-empty an NS is already outstanding, the function appends the data packet and...

UBUNTU-CVE-2026-23122

In the Linux kernel, the following vulnerability has been resolved: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW Use...

EUVD-2026-5914

In the Linux kernel, the following vulnerability has been resolved: igc: Reduce TSN TX packet buffer from 7KB to 5KB per queue The previous 7 KB per queue caused TX unit hangs under heavy timestamping load. Reducing to 5 KB avoids these hangs and matches the TSN recommendation in I225/I226 SW Use...

CVE-2025-39856

CVE-2025-39856 concerns the Linux kernel network driver for TI am65 CPSW-NUSS (CPSW2G) where, in the TX completion path, the variable ndev may be accessed before initialization if no TX packets have been processed. This can cause a null pointer dereference and kernel crash. Affected component: ne...

CVE-2025-38053

A flaw was found in the idpf module in the Linux kernel. A null pointer dereference can be triggered when the driver attempts to use a resource that has already been released, resulting in a denial of service...

CVE-2025-38053

Summary: A Linux kernel vulnerability (CVE-2025-38053) affects the idpf_features_check path used to validate TX skb features. The root cause is a NULL vport pointer in the netdev private structure after reset, which can lead to a kernel NULL pointer dereference when comparing skb header length wi...

CVE-2025-21903 mctp i3c: handle NULL header address

In the Linux kernel, the following vulnerability has been resolved: mctp i3c: handle NULL header address daddr can be NULL if there is no neighbour table entry present, in that case the tx packet should be dropped. saddr will usually be set by MCTP core, but check for NULL in case a packet is...

CVE-2024-53043

CVE-2024-53043 : Linux kernel vulnerability in mctp i2c handling NULL header address. The issue arises when daddr can be NULL if there is no neighbour table entry, in which case the tx packet should be dropped; saddr may be NULL if a different protocol transmits a packet. This could affect transm...