EUVD-2026-59402

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipcl2sendmsg Syzbot reported a slab-use-after-free in ipvlanhardheader when called from tipcl2sendmsg. The root cause is that tipcdisablel2media calls synchronizenet while b-mediaptr is still valid. This allows...

CVE-2026-74256

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: fix integer overflow in bpfmsgpopdata bounds check start and len are u32, so u64 last = start + len; evaluates start + len in 32-bit and wraps before storing it in last. The bounds check if start = offset + l || las...

CVE-2026-74255

In the Linux kernel, the following vulnerability has been resolved: tipc: fix UAF in tipcl2sendmsg Syzbot reported a slab-use-after-free in ipvlanhardheader when called from tipcl2sendmsg. The root cause is that tipcdisablel2media calls synchronizenet while b-mediaptr is still valid. This allows...

CVE-2026-72502

In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large, ip6defaultadvmss can return IPV6MAXPLEN 65535. This is interpreted by TCP as mssclamp, allowing the MSS to reach 65535. However, 0xFFFF is also...

EUVD-2026-59399

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-72500 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-72500 RDMA/bnxt_re: Free SRQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-72500

The CVE-2026-72500 vulnerability in the Linux kernel affects RDMA/bnxt_re and related code paths (bnxt_qplib_destroy_srq) where a toggle page is freed before firmware teardown completes. The root cause is freeing the page too early, allowing an NQ interrupt arriving during bnxt_qplib_destroy_srq(...

CVE-2026-72500

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free SRQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroysrq won't write the toggle values to an already-freed...

CVE-2026-72499

The CVE-2026-72499 issue is in the Linux kernel RDMA bnxt_re path. The vulnerability is resolved by changing the teardown order: free_page() is moved to occur after bnxt_qplib_destroy_cq(), so an NQ interrupt arriving during CQ destruction won’t write to an already-freed toggle page. Affected com...

CVE-2026-72499 RDMA/bnxt_re: Free CQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

EUVD-2026-59398

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72499 RDMA/bnxt_re: Free CQ toggle page after firmware teardown

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72499

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Free CQ toggle page after firmware teardown Free the toggle page only after firmware teardown completes so that an NQ interrupt arriving during bnxtqplibdestroycq won't write the toggle value to an already-freed page...

CVE-2026-72496

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Proper rollback if the ioremap fails bnxtqpliballocdpi returns success even if ioremap fails. Add the proper rollback when the ioremap fails and return -ENOMEM status...

CVE-2026-72494

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Replace waitqueue and flag with completion The driver previously used a waitqueue along with an explicit requestdone flag, but without proper barriers around requestdone. An earlier patch by Gui-Dong Han attempted to...

CVE-2026-72495

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxtre: Avoid repeated requests to allocate WC pages Applications can request multiple WC pages for the same ucontext. As of now, only 1 WC page per ucontext is supported. Add a lock to avoid concurrent access and a check to...

CVE-2026-72493 net: serialize netif_running() check in enqueue_to_backlog()

In the Linux kernel, the following vulnerability has been resolved: net: serialize netifrunning check in enqueuetobacklog Syzbot reported a KASAN slab-use-after-free in fibruleslookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistration...

EUVD-2026-59392

In the Linux kernel, the following vulnerability has been resolved: net: serialize netifrunning check in enqueuetobacklog Syzbot reported a KASAN slab-use-after-free in fibruleslookup. The root cause is a race condition where packets can escape the backlog flushing during device unregistration...

CVE-2026-72493

CVE-2026-72493 concerns a race condition in the Linux kernel where a lockless netif_running() check in enqueue_to_backlog() allowed a TOCTOU window during device backlog flushing on unregistration (e.g., netns exit). The issue can let packets escape backlog processing and trigger a use‑after‑free...