490 matches found
PT-2026-121945
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the AMT Automatic Multicast Tunneling module. An socket buffer skb queued in a queuing discipline qdisc can outlive the tunnel it references via a raw...
PT-2026-121860
In the Linux kernel, the following vulnerability has been resolved: wifi: libertas: reject short monitor TX frames In monitor mode, lbs hard start xmit casts skb-data to a radiotap TX header, skips that header, and then copies the 802.11 destination address from offset 4 in the remaining frame. T...
SUSE CVE-2026-98699
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
DEBIAN-CVE-2026-98699
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
CVE-2026-98699
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
CVE-2026-98699
The Linux kernel contains a Use-After-Free (UAF) vulnerability in the wifi: mac80211 component related to the mesh fast xmit path . The issue occurs because mesh_fast_tx_cache() stores raw mesh_path pointers; while path deletion flushes the cache and frees the path via kfree_rcu() , a concurrent ...
EUVD-2026-103953
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
CVE-2026-98699 wifi: mac80211: fix mesh fast xmit path deletion UAF
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
CVE-2026-98699
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
CVE-2026-98699: Undefined Security Weakness
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF meshfasttxcache stores raw meshpath pointers. Path deletion flushes the cache and then frees the path with kfreercu, but a lookup that already holds the path can insert a new...
PT-2026-117029
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix slab-out-of-bounds read in ieee80211 monitor select queue ieee80211 monitor select queue validates the skb length using skb-len before dereferencing pointers into skb-data to access the 802.11 header. However,...
PT-2026-116918
In the Linux kernel, the following vulnerability has been resolved: wifi: mac80211: fix mesh fast xmit path deletion UAF mesh fast tx cache stores raw mesh path pointers. Path deletion flushes the cache and then frees the path with kfree rcu, but a lookup that already holds the path can insert a...
Astra Linux – Vulnerability in Linux 5.15
In the Linux kernel, the following vulnerability has been resolved: xfrm: Policy issue: Fixing the metadata dst-dev xmit null pointer dereference. When we attempt to transmit an skb with metadatadst attached i.e., dst-dev == NULL through the xfrm interface, we may encounter a null pointer...
PT-2026-106603
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A conflict exists in the Linux kernel between the Paged Segment Protection PSP and the Transport Layer Security TLS Upper Layer Protocol ULP. This issue arises from the simultaneous usage o...
PT-2026-106537
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description A memory leak occurs in the sdio uart add port function when the sdio uart table is full. The function allocates the transmit fifo before securing a slot in the table; if all UART NR slots...
PT-2026-115828
In the Linux kernel, the following vulnerability has been resolved: net: stmmac: fix TSO header length truncation stmmac tso xmit stores the protocol header length returned by stmmac tso header size in a u8. stmmac tso valid packet admits headers up to 1023 bytes, so a header longer than 255 byte...
PT-2026-115740
In the Linux kernel, the following vulnerability has been resolved: wifi: virt wifi: free skb when disconnected When the simulated link is disconnected, virt wifi start xmit returns NET XMIT DROP without freeing the skb. dev hard start xmit treats this return value as consumed, so every packet se...
PT-2026-115757
In the Linux kernel, the following vulnerability has been resolved: mmc: sdio uart: fix xmit fifo leak when the port table is full sdio uart add port allocates the transmit fifo before claiming a slot in sdio uart table. When all UART NR slots are taken, it returns -EBUSY with the fifo still...
PT-2026-106680
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.10-1.1 Description An issue exists in the virt wifi module where the virt wifi start xmit function returns NET XMIT DROP without freeing the socket buffer skb when the simulated link is disconnected. Because...