SB2026102133 - SUSE update for the Linux Kernel
Published: October 21, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 112 vulnerabilities.
1) Memory leak (CVE-ID: CVE-2022-50645)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to memory leak within the pci_get_dev_wrapper() function in drivers/edac/i10nm_base.c. A local user can perform a denial of service (DoS) attack.
2) Race condition (CVE-ID: CVE-2025-39964) Exploited
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to a race condition within the include/crypto/if_alg.h. A local user can exploit the race and gain unauthorized access to sensitive information and escalate privileges on the system.
3) Input validation error (CVE-ID: CVE-2025-40022)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper input validation within the include/crypto/if_alg.h. A local user can perform a denial of service (DoS) attack.
4) Incomplete cleanup (CVE-ID: CVE-2026-100075)
CWE-ID: CWE-459 - Incomplete cleanup
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause incorrect send queue credit accounting.
The vulnerability exists due to incomplete cleanup in the srpt_alloc_rw_ctxs() error unwind path when handling an allocation failure partway through a multi-buffer indirect descriptor. A remote attacker can trigger the error path to cause incorrect send queue credit accounting.
5) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-43502)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in rds_message_purge() in the net/rds subsystem when cleaning up a failed zerocopy send before the message is queued. A local user can trigger an early zerocopy send failure to cause a denial of service.
The issue occurs after user pages have been pinned but before the message is attached to the sending socket.
6) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-53266) Exploited
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper memory handling in the ebtables SNAT target ARP sender hardware address rewrite in net/bridge/netfilter/ebt_snat.c when processing ARP packets in bridge netfilter hooks. A local user can trigger ARP sender hardware address rewriting on a crafted nonlinear skb to cause a denial of service.
Exploitation requires the ARP sender hardware address rewrite path to be reached with a nonlinear skb fragment backed by a splice-imported file page.
7) Race condition (CVE-ID: CVE-2026-53400)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the i2c adapter registration logic when looking up adapters by id during registration. A local user can trigger concurrent adapter lookup and registration activity to cause a denial of service.
The issue can lead to access to uninitialized adapter data, including NULL-pointer dereferences or use-after-free.
8) Use-after-free (CVE-ID: CVE-2026-64279)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the i2c core adapter lookup and deregistration logic when looking up an adapter by id during adapter deregistration or registration failure. A local user can trigger a race condition to cause a denial of service.
9) Out-of-bounds read (CVE-ID: CVE-2026-64319)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in nvmet_auth_reply() when processing a crafted DHCHAP_REPLY message. A remote attacker can send a specially crafted authentication reply message with inconsistent hash and DH value lengths to disclose sensitive information.
Exploitation is possible pre-authentication when DH authentication is configured.
10) Out-of-bounds read (CVE-ID: CVE-2026-64422)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.
Exploitation requires tcp_mtu_probing to be set to 2.
11) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-64556)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to improper state management in perf_event_remove_on_exec() and event group handling in the perf subsystem when removing events marked remove_on_exec. A local user can trigger event removal for a group leader with surviving siblings to corrupt kernel memory.
The issue occurs when a removed event is a group leader and sibling events without remove_on_exec remain active in a stale group state.
12) Double free (CVE-ID: CVE-2026-64580)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in xfrm6_fill_dst() when handling an error path after in6_dev_get(dev) returns NULL. A local user can trigger network operations that reach the affected code path to cause a denial of service.
The issue underflows a net_device reference count and can lead to kernel warnings while waiting for the device to become free.
13) Improper input validation (CVE-ID: CVE-2026-68155)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ceph_monmap_decode() when processing a CEPH_MSG_MON_MAP monmap message. A remote attacker can send a specially crafted monmap advertising zero monitors to cause a denial of service.
The issue is triggered when the client later attempts to open a session with a monitor, causing an assertion in pick_new_mon() to fire.
14) Integer overflow (CVE-ID: CVE-2026-68158)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an integer overflow in decode_new_up_state_weight() when processing a corrupted CEPH_MSG_OSD_MAP message containing a crafted osdmap. A remote attacker can send a specially crafted message to disclose sensitive information.
The issue can lead to out-of-bounds reads while decoding the new_state portion of the osdmap.
15) Out-of-bounds write (CVE-ID: CVE-2026-68159)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a stack out-of-bounds write in __decode_pg_temp(), __decode_pg_upmap_items(), and OSDMap handling in net/ceph/osdmap.c when processing a crafted OSDMap containing an oversized pg_temp, pg_upmap, or pg_upmap_items entry. A remote attacker can send a specially crafted OSDMap entry to cause a denial of service.
The issue is triggered when the decoded list is later copied into the fixed-size on-stack array struct ceph_osds.osds[CEPH_PG_MAX_SIZE].
16) Out-of-bounds read (CVE-ID: CVE-2026-68376)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in sctp_auth_get_hmac() when processing SCTP authentication parameters during association initialization. A local user can configure four HMAC identifiers to trigger memory corruption that leads to an out-of-bounds read and disclose sensitive information.
The issue stems from an undersized auth_hmacs array in struct sctp_cookie that can corrupt the adjacent auth_chunks field and cause an invalid HMAC identifier to be accepted.
17) Improper access control (CVE-ID: CVE-2026-68445)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to bypass shader validation and execute untrusted GPU shader code.
The vulnerability exists due to improper access control in vc4_gem_object_mmap() when handling mappings of validated shader buffer objects. A local user can map a validated shader buffer object read-only and then use mprotect() to make it writable to bypass shader validation and execute untrusted GPU shader code.
The issue affects validated shader buffer objects that are initially mapped read-only but can later be upgraded to writable mappings.
18) Improper input validation (CVE-ID: CVE-2026-68451)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in cca_ecc2protkey() when processing CCA ECC private key requests. A local user can supply a crafted key token with an oversized length field to cause a denial of service.
19) Improper input validation (CVE-ID: CVE-2026-68452)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in cca_cipher2protkey() when processing CCA AES cipher key requests. A local user can supply a key token with an excessive length field to cause a denial of service.
The copy length for the CPRB parameter block is derived directly from the length field in the key token.
20) NULL pointer dereference (CVE-ID: CVE-2026-68454)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a null page reference in kvm_s390_pci_aif_enable() in the KVM s390 PCI code when registering IRQs without a summary bit specified. A local user can request IRQ registration without an AISB to cause a denial of service.
The issue is triggered when a guest enables adapter interruption forwarding without specifying a summary bit.
21) Improper access control (CVE-ID: CVE-2026-72051)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.
The vulnerability exists due to improper access control in ip6_tnl_changelink() when handling changelink requests for IPv6 tunnel devices across network namespaces. A local privileged user can send a crafted netlink changelink request to modify tunnel configuration across network namespaces.
The issue occurs when the device network namespace differs from the tunnel link network namespace.
22) Improper access control (CVE-ID: CVE-2026-72052)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to modify tunnel link configuration across network namespaces.
The vulnerability exists due to improper access control in ip6gre_changelink() and ip6erspan_changelink() when handling changelink requests for devices and tunnel links in different network namespaces. A remote privileged user can send a crafted changelink request to modify tunnel link configuration across network namespaces.
The issue occurs when the device network namespace differs from the tunnel link network namespace, causing capability checks to be applied only to the device namespace.
23) Improper access control (CVE-ID: CVE-2026-72053)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to modify IPIP tunnel configuration in another network namespace.
The vulnerability exists due to improper access control in ipip_changelink() in net/ipv4/ipip.c when handling changelink requests for an IPIP device whose tunnel link resides in a different network namespace. A local privileged user can send a changelink request from a network namespace where they have CAP_NET_ADMIN to modify IPIP tunnel configuration in another network namespace.
The issue occurs when dev_net(dev) and the tunnel link namespace differ, such as after the device is created in or moved to a different network namespace.
24) Improper access control (CVE-ID: CVE-2026-72054)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.
The vulnerability exists due to improper access control in vti_changelink() in the ip_vti component when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.
The issue occurs when the device is created in or moved to a different network namespace than the one from which the request is issued.
25) Improper access control (CVE-ID: CVE-2026-72055)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.
The vulnerability exists due to improper access control in vti6_changelink() in the ip6_vti component when handling changelink requests for a tunnel device associated with another network namespace. A local privileged user can send a changelink request from a namespace where they hold CAP_NET_ADMIN to modify tunnel configuration across network namespaces.
The issue arises when the device network namespace and the tunnel link network namespace differ.
26) Improper access control (CVE-ID: CVE-2026-72061)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to modify tunnel configuration across network namespaces.
The vulnerability exists due to improper access control in ipip6_changelink() in the sit tunnel handler when handling changelink requests for a tunnel whose link network namespace differs from the device network namespace. A local privileged user can send a changelink request to modify tunnel configuration across network namespaces.
The issue occurs when the caller has CAP_NET_ADMIN in the device network namespace but not in the tunnel link network namespace.
27) Stack-based buffer overflow (CVE-ID: CVE-2026-72066)
CWE-ID: CWE-121 - Stack-based buffer overflow
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a stack-based buffer overflow in states_show() in kernel/cpu.c when generating sysfs output for CPU hotplug states. A local user can read the affected sysfs entry to cause a denial of service.
28) Use-after-free (CVE-ID: CVE-2026-72083)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in core_scsi3_emulate_pro_register_and_move() when processing a crafted iSCSI TransportID in a PERSISTENT RESERVE OUT REGISTER AND MOVE parameter list. A remote user can send a specially crafted request to cause a denial of service.
The issue is triggered when the parameter list spans more than one page, causing the ISID pointer to reference an unmapped region after the buffer is torn down.
29) Out-of-bounds read (CVE-ID: CVE-2026-72084)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in iSCSI PR-OUT TransportID parsing in the Linux kernel SCSI target subsystem when processing a crafted PERSISTENT RESERVE OUT TransportID buffer. A remote attacker can send a specially crafted PR OUT request to cause a denial of service.
The issue is reachable through any fabric that delivers a PR OUT to a device exported through an iSCSI target portal group, including a guest via vhost-scsi.
30) Out-of-bounds write (CVE-ID: CVE-2026-72098)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in dm-verity fec calculation when processing erasure data during FEC decoding. A local user can trigger crafted corruption conditions to cause memory corruption.
The out-of-bounds write can occur when the erasure count exceeds the intended Reed-Solomon roots limit and the decoder writes past the end of the lambda array into the syndrome buffer.
31) Out-of-bounds read (CVE-ID: CVE-2026-72129)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in nvmet_rdma_use_inline_sg() and inline scatterlist handling in the NVMe target RDMA component when processing host-controlled inline data with a nonzero offset. A remote user can send crafted inline data offsets and lengths to cause a denial of service.
The issue can be triggered when inline_data_size is configured larger than PAGE_SIZE, and page-spanning in-bounds ranges may also cause the scatterlist to be under-counted.
32) Improper access control (CVE-ID: CVE-2026-72136)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to modify an xfrm interface across network namespace boundaries.
The vulnerability exists due to improper access control in xfrmi_changelink() when handling changelink requests for xfrm interfaces. A local privileged user can send a changelink request from one network namespace to rewrite an interface that lives in another network namespace to modify an xfrm interface across network namespace boundaries.
The issue occurs because the capability check was performed only against dev_net(dev) and not against the interface link network namespace.
33) Out-of-bounds write (CVE-ID: CVE-2026-72157)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to an out-of-bounds write in tbnet_poll() when processing a multi-frame ThunderboltIP packet with a peer-supplied frame_count that exceeds the fragment array capacity. A remote attacker can send a specially crafted packet with 19 or more small frames to corrupt memory.
The issue occurs because the first frame is placed in the skb linear area while subsequent frames are added as page fragments.
34) Improper access control (CVE-ID: CVE-2026-72164)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to overwrite file data belonging to another inode.
The vulnerability exists due to improper allocation of occupied clusters in ocfs2_move_extent() and ocfs2_probe_alloc_group() when processing a non-auto OCFS2_IOC_MOVE_EXT operation with a user-supplied physical goal. A local user can supply a crafted occupied goal value to overwrite file data belonging to another inode.
The issue occurs when the supplied goal is at the end of the target block group or when the free-run start is miscalculated.
35) Use-after-free (CVE-ID: CVE-2026-72322)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a use-after-free in the IPv6 MLD delayed work handling in net/ipv6/mcast.c when processing incoming MLD queries during device teardown. A remote attacker can send crafted MLD query traffic to trigger a kernel panic and cause a denial of service.
The issue arises from a race condition between device destruction and packet receive processing under RCU protection.
36) Use-after-free (CVE-ID: CVE-2026-72323)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the IGMP timer callback when processing incoming IGMP queries during device teardown. A remote attacker can send a crafted IGMP query to cause a denial of service.
Exploitation requires a race between device destruction and IGMP query processing.
37) Off-by-one (CVE-ID: CVE-2026-72339)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an off-by-one error in the qede_rx_build_skb() and qede_tpa_rx_build_skb() functions when handling a NULL return from qede_build_skb() under memory pressure. A local user can trigger memory pressure and network receive processing to cause memory corruption.
The issue can desynchronize the BD ring, which can corrupt DMA page reference counts and lead to SLUB freelist corruption.
38) Improper input validation (CVE-ID: CVE-2026-72348)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to bypass packet-filtering rules.
The vulnerability exists due to improper input validation in the ip6tables ah, hbh, and rt IPv6 extension header match handlers when processing malformed IPv6 packets with advertised extension header lengths that exceed the available skb data. A remote attacker can send a specially crafted IPv6 packet to bypass packet-filtering rules.
The issue affects handling of malformed IPv6 authentication, hop-by-hop, and routing extension headers.
39) Out-of-bounds read (CVE-ID: CVE-2026-72351)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in gue_remcsum() and gue_gro_remcsum() when processing malformed GUE packets with the REMCSUM private flag set but without the required REMCSUM metadata fields. A remote attacker can send a specially crafted packet to disclose sensitive information.
The issue occurs because option validation accepts packets that contain only the private flags field even when additional REMCSUM start and offset fields are expected.
40) Use-after-free (CVE-ID: CVE-2026-72383)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to use-after-free in sctp_free_addr_wq() and sctp_addr_wq_timeout_handler() when handling addr_wq_timer teardown. A local attacker can trigger a race condition to cause a denial of service.
The issue arises because a timer handler may continue running after the associated wait queue has been freed.
41) Improper input validation (CVE-ID: CVE-2026-72398)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to tamper with SCTP association handling and cause a denial of service.
The vulnerability exists due to improper input validation in SCTP COOKIE-ECHO processing paths when processing a cookie containing a reconstructed INIT chunk while cookie authentication is disabled. A remote attacker can send a specially crafted COOKIE-ECHO packet to tamper with SCTP association handling and cause a denial of service.
The issue only arises when cookie authentication is disabled.
42) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72434)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper shutdown of delayed work in the ipset garbage collector in netfilter when destroying a set with timeouts enabled. A local user can destroy a crafted set to cause a denial of service.
Only sets configured with timeout support are affected.
43) Double free (CVE-ID: CVE-2026-72449)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a double free in kfd_criu_resume_svm() when handling a second AMDKFD_IOC_CRIU_OP request from the same process via /dev/kfd. A local user can trigger repeated cleanup of freed list entries to cause a denial of service.
The issue is reachable by an unprivileged render-group user and is caused by stale list entries left in the criu_svm_metadata_list after cleanup.
44) Improper Initialization (CVE-ID: CVE-2026-74267)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper state management in sch_codel when peeking queued packets after packet drops. A local user can trigger packet drops during peek to cause a denial of service.
The issue can incorrectly invoke the parent qlen_notify callback while a packet still remains queued, which may deactivate the parent class unexpectedly.
45) Improper access control (CVE-ID: CVE-2026-74283)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify TIPC state.
The vulnerability exists due to improper access control in TIPCv2 generic-netlink mutator operations when handling netlink administrative commands. A local user can invoke mutating netlink operations to modify TIPC state.
The issue affects commands that can change the network id and node identity, set or flush key material, and enable or disable a UDP bearer.
46) Race condition (CVE-ID: CVE-2026-74330)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in configfs directory entry child traversal when traversing s_children lists while concurrent cursor movement or freeing can occur. A local user can trigger concurrent configfs operations to cause a denial of service.
The issue affects configfs directory handling in fs/configfs/dir.c.
47) Use-after-free (CVE-ID: CVE-2026-74388)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the ALSA OSS sequencer event handling logic when processing SysEx data embedded in MIDI events and dispatching a pending event after a sequencer port is closed concurrently. A local user can send crafted MIDI bytes that produce a pending SysEx event with a stale pointer to cause a denial of service.
The issue occurs during concurrent port closure before deferred event dispatch.
48) Race condition (CVE-ID: CVE-2026-74398)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition in addrconf_dad_failure in the IPv6 address configuration subsystem when handling duplicate address detection failure processing concurrently with IPv6 address deletion. A local attacker can trigger concurrent state transitions to cause a denial of service.
The issue can lead to a general protection fault when a deleted IPv6 address entry is processed a second time through scheduled DAD work.
49) NULL pointer dereference (CVE-ID: CVE-2026-74406)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in vxlan_gro_prepare_receive() when processing packets during GRO handling. A local attacker can trigger concurrent socket state changes to cause a denial of service.
50) Out-of-bounds write (CVE-ID: CVE-2026-74443)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify authenticated command fields.
The vulnerability exists due to an out-of-bounds write in vmw_cmd_dma() in the vmwgfx command verifier when processing a dma command with an undersized header body size. A local user can submit a specially crafted command to modify authenticated command fields.
The issue arises from a suffix pointer underflow that can clobber fields in a previously relocated command in the device-visible command stream.
51) Out-of-bounds read (CVE-ID: CVE-2026-74444)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in vmw_cmd_draw() when processing a user-supplied command stream containing an undersized DRAW_PRIMITIVES header. A local user can supply a crafted command stream to disclose sensitive information.
The issue is triggered when header->size is smaller than the command body size, causing an unsigned subtraction to wrap and a subsequent bounds check to be bypassed.
52) Improper input validation (CVE-ID: CVE-2026-74453)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in validate_tile_binning_config when processing tile binning configurations with oversized tile state arrays. A local user can submit a crafted tile binning configuration that leaves no room for the tile allocation pool to cause a denial of service.
The tile state data array size is derived from tile count fields and shares the same buffer slot with the tile allocation pool.
53) Improper Initialization (CVE-ID: CVE-2026-74453)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper initialization in the vc4 tile state data array handling when submitting crafted tile binning configurations. A local user can submit a crafted job that reuses stale tile state data to cause a denial of service.
The issue can result in invalid command streams, invalid primitive streams, and GPU hangs.
54) Out-of-bounds write (CVE-ID: CVE-2026-74469)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in SCTP sock_diag when processing a diagnostic dump after adding many unique peer transports. A local user can add unique peer addresses until the 16-bit transport_count wraps and trigger a diagnostic dump to cause a denial of service.
The issue occurs when the association accumulates 65,536 unique peer transports, causing transport_count to wrap to zero while peer addresses are still copied from transport_addr_list.
55) Out-of-bounds read (CVE-ID: CVE-2026-74473)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in route_shortcircuit() in drivers/net/vxlan/vxlan_core.c when processing packets with a non-linear buffer layout. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because the network header may not be fully pulled into the linear buffer before ip_hdr(skb)->daddr or ipv6_hdr(skb)->daddr is dereferenced.
56) Use-after-free (CVE-ID: CVE-2026-74479)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the pktgen proc entry handling in net/core/pktgen.c when concurrently removing and renaming pktgen devices. A local user can trigger a race condition involving proc_remove() on a stale proc_dir_entry to cause a denial of service.
The issue occurs because pktgen_change_name() and pktgen_remove_device() access the same proc entry with inconsistent locking, and exploitation requires winning a race between those paths.
57) Use-after-free (CVE-ID: CVE-2026-74480)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in br_multicast_leave_group() in the bridge multicast handling code when processing fast-leave operations on port groups. A local user can trigger deletion of a matching port group to cause a denial of service.
The issue can occur when multicast-to-unicast had been enabled, allowing multiple port groups for the same port and group with different source MAC addresses, and is later disabled so entries are matched by port only.
58) Use-after-free (CVE-ID: CVE-2026-74492)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in mtype_add() when processing packet-side add operations during ipset table resizing. A remote user can trigger xt_SET --add-set ... --exist updates to cause a denial of service.
The issue occurs when a replacement-table entry and an old-table entry temporarily share the same comment pointer during resize and backlog replay, leading to a stale pointer dereference in strlen().
59) Use-after-free (CVE-ID: CVE-2026-74493)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in __smc_lgr_terminate() in the SMC networking subsystem when terminating a link group while a concurrent close unregisters a connection. A local user can trigger overlapping close and link group termination operations to cause a denial of service.
The issue is caused by a race condition involving socket reference handling for a connection stored in lgr->conns_all.
60) Use-after-free (CVE-ID: CVE-2026-74540)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in l2cap_le_connect_rsp() in the Bluetooth L2CAP subsystem when handling a crafted LE connect response during channel processing. A remote attacker can trigger a remote disconnect race to cause a denial of service.
61) Heap-based buffer overflow (CVE-ID: CVE-2026-74556)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a heap-based buffer overflow in iscsi_tcp_hdr_dissect() in libiscsi_tcp when processing a crafted iSCSI SCSI Command Response pdu. A remote attacker can send a specially crafted response with an oversized data segment to cause a denial of service.
The issue occurs because sense or response data for ISCSI_OP_SCSI_CMD_RSP can exceed the fixed 8192-byte connection buffer while remaining within the negotiated maximum receive data segment length.
62) Use-after-free (CVE-ID: CVE-2026-74586)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to use-after-free in SCTP ASCONF handling when processing an authenticated ASCONF chunk that adds and removes a peer transport in the same chunk. A remote user can send a specially crafted authenticated ASCONF message to cause a denial of service.
The issue occurs because a stale new_transport pointer can be used when a queued HEARTBEAT is later processed during local address replacement.
63) Use-after-free (CVE-ID: CVE-2026-74588)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in __sctp_outq_flush_rtx() and SCTP transport tracking when processing SCTP SACKs after transport removal. A remote user can send crafted SCTP control traffic to cause a denial of service.
Exploitation requires an SCTP association peer to trigger transport removal through ASCONF Delete-IP and then send a SACK that reneges on the TSN.
64) Use-after-free (CVE-ID: CVE-2026-74589)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in tcp_bpf_send_verdict() and tcp_bpf_sendmsg_redir() when processing concurrent sendmsg() operations with a cached redirect verdict. A local user can trigger concurrent socket send operations to cause a denial of service.
The issue occurs when apply_bytes keeps the cached verdict active, allowing one thread to release the redirect socket reference while another thread still uses a stale pointer.
65) Out-of-bounds write (CVE-ID: CVE-2026-74597)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to an out-of-bounds write in ip6ip6_err() and the IPv6 ICMP error reply path when processing a quoted inner IPv6 packet after cloning an outer IPv6 ICMP error skb with stale inet6_skb_parm metadata. A remote attacker can send a specially crafted IPv6 packet to corrupt memory.
Exploitation requires the outer packet to carry a Home Address Option and a malformed inner destination-options header.
66) Use-after-free (CVE-ID: CVE-2026-74609)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in tipc_node_link_down() in the TIPC subsystem when handling link-down events and bearer disable operations concurrently. A local user can trigger a race condition that frees a link object while it is still being dereferenced to cause a denial of service.
The issue can result in both a use-after-free read in tipc_link_is_establishing() and a use-after-free write via tipc_link_reset() during the establishing branch.
67) Use-after-free (CVE-ID: CVE-2026-74615)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to a use-after-free in the vxlan ageing timer handling in drivers/net/vxlan/vxlan_core.c when changing link ageing settings on a device that is down. A remote user can create and delete a VXLAN device in a new user and network namespace to cause a denial of service.
The affected operations are network-namespace scoped.
68) Out-of-bounds write (CVE-ID: CVE-2026-74616)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to an out-of-bounds write in xdpf_clone() and the XDP-to-skb conversion path when converting crafted cloned XDP frames into sk_buffs. A local user can trigger conversion of a crafted clone that overlaps skb_shared_info tailroom to cause memory corruption.
69) Use-after-free (CVE-ID: CVE-2026-74630)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to use-after-free in in6_dev_get() and inet6_dev handling when processing IPv6 device state during concurrent device teardown. A local user can trigger network operations that race with device teardown to cause a denial of service or execute arbitrary code.
The issue arises from invalid reference acquisition after the object reference count has already reached zero, and the freed object may be accessed after the RCU read-side section ends.
70) Use-after-free (CVE-ID: CVE-2026-74688)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP control chunk handling logic when transmitting a queued HEARTBEAT ACK after the associated peer transport has been removed. A remote attacker can trigger peer transport removal while a control chunk retains a stale transport pointer to cause a denial of service.
The issue occurs when src_out_of_asoc_ok is enabled and the HEARTBEAT ACK remains queued on control_chunk_list instead of being transmitted immediately.
71) Race condition (CVE-ID: CVE-2026-74700)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a use-after-free.
The vulnerability exists due to a race condition in net/sched/cls_api.c when handling concurrent classifier creation requests in the same chain and priority. A local user can trigger concurrent u32 and flower filter operations to cause a use-after-free.
Exploitation requires concurrent requests that race during tc_new_tfilter processing.
72) Memory leak (CVE-ID: CVE-2026-74719)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in smc_llc_event_handler() when handling duplicate CONFIRM_LINK or ADD_LINK_CONT messages while a local LLC flow is active and a qentry is already pending. A remote attacker can send duplicate crafted messages to cause a denial of service.
The issue affects the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT handling path, while the response direction is not affected.
73) Out-of-bounds read (CVE-ID: CVE-2026-74737)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an out-of-bounds memory access in the am65-cpsw-nuss packet reception path when processing RX DMA descriptor metadata containing the source tag. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because the driver uses the full 16-bit source tag as the port identifier even though only the lower 8 bits represent the MAC port ID, while the upper 8 bits are hardware-reserved and may contain arbitrary values.
74) Use-after-free (CVE-ID: CVE-2026-74743)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a use-after-free in the macvlan network device handling in drivers/net/macvlan.c when processing packets on a macvlan device backed by a lower device that requires additional headroom or tailroom. A remote attacker can send network traffic that triggers insufficient buffer space handling to execute arbitrary code.
The issue can be triggered when the lower device requires extra header or trailer space, such as with macsec, ipsec, wireguard, tunnels, or veth with rx headroom.
75) Use-after-free (CVE-ID: CVE-2026-74744)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a use-after-free in the ipvlan network device component when handling packet header and tailroom requirements inherited from the underlying physical device. A remote attacker can trigger packet processing that causes insufficient headroom or tailroom reservation to execute arbitrary code.
The issue can occur when the underlying physical or stacked lower device requires extra headroom or tailroom for headers or trailers.
76) Out-of-bounds read (CVE-ID: CVE-2026-74752)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted RANDOM length to disclose sensitive information.
The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.
77) Out-of-bounds write (CVE-ID: CVE-2026-74752)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in SCTP COOKIE_ECHO handling when processing peer-controlled cookie AUTH fields with cookie authentication disabled. A remote attacker can send a forged cookie with a crafted HMAC identifier to execute arbitrary code.
The issue is reachable when cookie authentication is disabled, and malformed AUTH parameters restored from the cookie are not validated against local backing arrays.
78) Integer overflow (CVE-ID: CVE-2026-80540)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to an integer overflow in the amdgpu UVD decode message handler when processing crafted decode parameters. A local user can supply a crafted pitch value to trigger the overflow and execute arbitrary code.
The issue is in the Linux kernel DRM AMDGPU UVD decode path.
79) Out-of-bounds write (CVE-ID: CVE-2026-80580)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code.
The vulnerability exists due to an out-of-bounds write in the fbdev sysfs mode output handling in drivers/video/fbdev/core/fbsysfs.c when processing a long modelist for sysfs output. A local user can trigger sysfs mode listing with a sufficiently long modelist to execute arbitrary code.
80) Use-after-free (CVE-ID: CVE-2026-80714)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the ipvs connection handling logic when binding synced connections to a destination. A local user can trigger creation and expiry of a crafted synced connection state to cause a denial of service.
The issue occurs when a synced connection inherits the one-packet flag after it is already hashed, which can leave stale hash nodes pointing to a freed struct ip_vs_conn.
81) Use-after-free (CVE-ID: CVE-2026-80716)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in snd_pcm_drain() and snd_pcm_unlink() in the ALSA PCM subsystem when unlinking a drained or draining linked stream while a drain wait is pending. A local user can trigger stream unlinking to cause a denial of service.
The issue occurs when group membership changes during the wait and the wait ends by signal or timeout, leaving an on-stack wait entry queued on a sleep list.
82) Use-after-free (CVE-ID: CVE-2026-80737)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause memory corruption.
The vulnerability exists due to a use-after-free in the AMBA PL011 serial driver's DMA shutdown handling when DMA activity is being terminated. A local user can trigger DMA shutdown while TX callbacks or RX polling remain active to cause memory corruption.
83) Use-after-free (CVE-ID: CVE-2026-80785)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to store a stale pointer to freed memory in fb_info->mode.
The vulnerability exists due to a use-after-free race condition in the fbdev mode sysfs handlers in drivers/video/fbdev/core/fbsysfs.c when concurrently accessing mode sysfs attributes while the modelist is replaced. A local user can race mode sysfs reads or writes with modelist replacement to store a stale pointer to freed memory in fb_info->mode.
84) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-80789)
CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to uncontrolled resource allocation in nvmet_tcp_map_data() when processing write commands containing non-inline transport SGL data-block descriptors. A remote attacker can submit a crafted NVMe/TCP command with an oversized SGL length to cause a denial of service.
For write commands, the target waits for host data after issuing an R2T response.
85) Out-of-bounds write (CVE-ID: CVE-2026-80840)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause an out-of-bounds write.
The vulnerability exists due to improper initialization of the IPv4 control block in the IPv6 Segment Routing decapsulation path when processing a specially crafted IPv6 packet containing an encapsulated IPv4 TCP SYN packet. A remote attacker can send a specially crafted packet with controlled IPv6 extension-header and IPv4 option data to cause an out-of-bounds write.
86) Use-after-free (CVE-ID: CVE-2026-80841)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in AF_PACKET TX_RING handling when closing a socket or replacing a transmit ring while transmit skbs remain pending. A local user can close a socket or replace a transmit ring while transmit skbs remain pending to cause a denial of service.
The issue is limited to vmalloc-backed transmit-ring blocks.
87) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-80844)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds memory access.
The vulnerability exists due to improper validation of routing header segments_left values in ipv6_rearrange_rthdr() when processing raw IPv6 HDRINCL packets with a segments_left value larger than the number of addresses described by hdrlen. A local user can send a crafted packet with an oversized segments_left value to cause an out-of-bounds memory access.
88) Out-of-bounds write (CVE-ID: CVE-2026-80852)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds write in tls_append_frag() in the TLS device offload implementation when repeatedly splicing small amounts of data into a TLS_TX_ZEROCOPY_RO socket using SPLICE_F_MORE and MSG_MORE. A local user can cause the fragment count to exceed the maximum array bound to cause a denial of service.
The vulnerable path requires TLS device offload support.
89) Integer overflow (CVE-ID: CVE-2026-80909)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an integer overflow during minimum DPB size calculation.
The vulnerability exists due to improper validation of the H.265 reference count in the AMDGPU UVD message decoder when decoding UVD messages. A local user can submit a UVD message with an invalid number of H.265 references to cause an integer overflow during minimum DPB size calculation.
90) Integer underflow (CVE-ID: CVE-2026-81000)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write packet data outside allocated memory.
The vulnerability exists due to an integer underflow in TUN and TAP interface handling in tun_get_user() when processing an oversized headroom request propagated by an OVS port. A local user can configure an OVS port to propagate an oversized headroom request to a TUN or TAP device to write packet data outside allocated memory.
91) Use-after-free (CVE-ID: CVE-2026-89479)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access freed memory.
The vulnerability exists due to use-after-free in the SCTP endpoint receive loop when processing a specially crafted SCTP packet containing bundled chunks. A remote attacker can send an SCTP packet that deletes an association before subsequent chunks are processed to access freed memory.
Exploitation requires the packet to be processed from the socket backlog in task context.
92) Out-of-bounds write (CVE-ID: CVE-2026-89482)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of C2HData requests in the NVMe/TCP receive path when handling C2HData for a WRITE_ZEROES command with a residual iterator on the same tag. A remote attacker can send a C2HData request to trigger a wild memory write and cause a denial of service.
93) Out-of-bounds read (CVE-ID: CVE-2026-89532)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an integer underflow resulting in an out-of-bounds read in the pcl_for_each_segment macro when processing a Write or Reply chunk with zero segments. A remote attacker can send a crafted Write or Reply chunk advertising zero segments to cause a denial of service.
The transport must have negotiated Send-With-Invalidate.
94) Integer underflow (CVE-ID: CVE-2026-89533)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer underflow in svc_rdma_read_chunk_range() when processing a Read chunk segment list with crafted offsets and lengths. A remote attacker can submit a crafted Read chunk to cause a denial of service.
95) NULL pointer dereference (CVE-ID: CVE-2026-89544)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper error handling in the SUNRPC gssx XDR option-array decoder when handling an allocation failure while decoding an option array. A local user can trigger the decoder's error path to cause a denial of service.
The affected error paths also include a group_info reference-count leak and a latent use-after-free condition.
96) Integer underflow (CVE-ID: CVE-2026-89551)
CWE-ID: CWE-191 - Integer underflow
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause downstream XDR decoders to use an incorrect stream bound.
The vulnerability exists due to an integer underflow in xdr_buf_trim() when processing GSS Kerberos v2 data whose recorded buffer length is smaller than the associated I/O vector lengths. A remote attacker can cause xdr_buf_trim() to consume more bytes than buf->len records to cause downstream XDR decoders to use an incorrect stream bound.
97) Use-after-free (CVE-ID: CVE-2026-89569)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to access freed RFCOMM session and data link connection objects.
The vulnerability exists due to use-after-free in the RFCOMM security confirmation handler rfcomm_security_cfm() when processing Bluetooth security confirmations concurrently with RFCOMM session teardown. A remote attacker can trigger the concurrent processing to access freed RFCOMM session and data link connection objects.
98) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-89603)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute system calls prohibited by a seccomp filter.
The vulnerability exists due to a race condition in syscall_trace_enter() when a thread is stopped for ptrace while another thread installs a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC. A local user can install a seccomp filter with SECCOMP_FILTER_FLAG_TSYNC while another thread is stopped for ptrace to execute system calls prohibited by the filter.
The system call number may be modified during ptrace handling.
99) Out-of-bounds read (CVE-ID: CVE-2026-89631)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in the CIFSTCon() SMB client tree connect response parser when processing a tree connect response with a byte count smaller than two. A remote attacker can send a malformed tree connect response to disclose sensitive information.
Disclosed bytes are exposed through /proc/fs/cifs/DebugData.
100) Use-after-free (CVE-ID: CVE-2026-89636)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a use-after-free.
The vulnerability exists due to use-after-free in the SMB client DFS cache's free_tgts() function when using ce->tgthint after its target entries have been freed. A local user can trigger use of the stale target cache hint to cause a use-after-free.
101) Improper Preservation of Permissions (CVE-ID: CVE-2026-89638)
CWE-ID: CWE-281 - Improper preservation of permissions
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to improper preservation of permissions in the cifs_setattr_unix() and cifs_setattr_nounix() routines when processing writes to files with setuid or setgid bits set. A local user can write to such a file and retain its setuid or setgid bits on the server to escalate privileges.
The issue occurs when the mount stores modes on the server through cifsacl or modefromsid, SMB3.1.1 POSIX extensions, or SMB1 Unix extensions.
102) Out-of-bounds write (CVE-ID: CVE-2026-89674)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.
The vulnerability exists due to an incorrect XDR buffer size calculation in nfsd4_ff_encode_layoutget() when encoding layoutget responses with short user or group strings and an odd-sized file handle. A remote attacker can request a layoutget operation to write beyond the reserved XDR buffer or disclose uninitialized kernel memory.
103) Improper initialization (CVE-ID: CVE-2026-89932)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose or modify sensitive information, or cause a denial of service.
The vulnerability exists due to improper initialization of last_vpid in KVM nested VMX VPID management when reusing a VPID after an L1 guest transitions from VMXOFF to VMXON and runs an L2 guest. A local user can cause stale TLB entries associated with a previous VPID lifetime to be used to disclose or modify sensitive information, or cause a denial of service.
104) Improper Enforcement of Behavioral Workflow (CVE-ID: CVE-2026-89968)
CWE-ID: CWE-841 - Improper Enforcement of Behavioral Workflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of protocol state in nvmet_tcp_handle_h2c_data_pdu() when processing an unsolicited H2CData PDU before transmitting a requested data transfer (R2T). A remote attacker can send an H2CData PDU for a write command before the R2T is transmitted to cause a denial of service.
The affected subsystem must be configured with allow_any_host.
105) Use-after-free (CVE-ID: CVE-2026-90003)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to execute arbitrary code, disclose sensitive information, or cause a denial of service.
The vulnerability exists due to a use-after-free in the futex requeue priority-inheritance handling when racing an early waiter wakeup with a priority-inheritance futex requeue. A local user can trigger FUTEX_CMP_REQUEUE_PI operations to access a waiter's stack-allocated futex queue after the waiter returns from the system call.
Exploitation is limited to systems using PREEMPT_RT.
106) Access of Uninitialized Pointer (CVE-ID: CVE-2026-90104)
CWE-ID: CWE-824 - Access of Uninitialized Pointer
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to an uninitialized pointer in the NFSv4.1 callback sequence argument decoder when handling NFSv4.1 callback sequence arguments containing an empty referring call list. A remote attacker can send a crafted NFSv4.1 callback request to cause a denial of service.
107) Use-after-free (CVE-ID: CVE-2026-90198)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free.
The vulnerability exists due to a use-after-free in snd_card_do_free() when a managed sound card is unbound while an application retains an open file descriptor. A local user can close the open file descriptor while the managed sound card is being unbound to trigger a use-after-free.
108) Out-of-bounds read (CVE-ID: CVE-2026-90413)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read out-of-bounds memory.
The vulnerability exists due to an out-of-bounds read in the iSER login PDU handling code when processing a login PDU whose declared data segment length exceeds the received payload length. A remote attacker can send a crafted login PDU with an oversized declared data segment length to read out-of-bounds memory.
The issue can be triggered before authentication.
109) Out-of-bounds read (CVE-ID: CVE-2026-90414)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote user to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.
The vulnerability exists due to missing validation of the declared data segment length in isert_recv_done() when processing iSER/iSCSI PDUs. A remote user can send a PDU that declares a data segment larger than the received data to cause an out-of-bounds read and write heap contents beyond the receive descriptor to backing storage.
Exploitation requires the full feature phase and negotiated parameters that permit unsolicited or immediate data.
110) Use-after-free (CVE-ID: CVE-2026-93104)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a use-after-free.
The vulnerability exists due to returning a dangling pointer in rvt_alloc_device when allocating a port array. A local user can trigger a port-array allocation failure to cause a use-after-free.
111) Race condition (CVE-ID: CVE-2026-93782)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to write response data to an unrelated userspace object.
The vulnerability exists due to a race condition in vhost-scsi ioctl handling when replacing the memory table while commands are in flight. A local user can submit commands and issue VHOST_SET_MEM_TABLE to write response data to an unrelated userspace object.
112) Out-of-bounds read (CVE-ID: CVE-2026-93787)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause an out-of-bounds read.
The vulnerability exists due to improper bounds checking in cifs_filldir() when processing SMB1 TRANS2 directory enumeration responses. A remote attacker can return a directory entry with an oversized FileNameLength to cause an out-of-bounds read.
User interaction is required to list a directory on a CIFS mount served by an attacker-controlled SMB1 server.
Remediation
Install update from vendor's website.