SB2026110105 - SUSE update for the Linux Kernel
Published: November 1, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 110 vulnerabilities.
1) Improper locking (CVE-ID: CVE-2025-68358)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform a denial of service (DoS) attack.
The vulnerability exists due to improper locking within the fs/btrfs/space-info.h. A local user can perform a denial of service (DoS) attack.
2) Use-after-free (CVE-ID: CVE-2026-43091)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in xfrm policy_bydst hash tables during network namespace teardown when concurrent RCU-protected policy lookups are performed. A local user can trigger network namespace teardown while the tables are still being accessed to cause a denial of service.
The issue occurs because the memory can be freed before an RCU grace period has elapsed.
3) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43132)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of error pointers in verity_fec_ctr() when creating dm-bufio clients. A local user can trigger a failure in dm_bufio_client_create() to cause a denial of service.
4) Improper Initialization (CVE-ID: CVE-2026-43184)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to improper initialization in rnbd-srv response buffer handling when exchanging response messages between different protocol versions. A remote attacker can trigger communication using mismatched protocol versions to disclose sensitive information.
The issue arises because stray bytes in the response buffer may be picked up by the client side.
5) Improper resource shutdown or release (CVE-ID: CVE-2026-43283)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in dma_free_coherent() in the ec_bhf ethernet driver when handling an error path during buffer cleanup. A local user can trigger the error path to cause a denial of service.
6) Improper Check or Handling of Exceptional Conditions (CVE-ID: CVE-2026-43299)
CWE-ID: CWE-703 - Improper Check or Handling of Exceptional Conditions
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a read-only filesystem state in btrfs_repair_io_failure() when processing read-repair operations after the filesystem flips to read-only following a critical error. A local user can trigger the error condition to cause a denial of service.
The issue is triggered when a read repair is pending while the filesystem becomes read-only due to a critical error such as ENOSPC in a critical path.
7) Improper resource shutdown or release (CVE-ID: CVE-2026-43457)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the mctp i2c receive path when handling received packets while midev->allow_rx is false. A local user can trigger packet reception in this state to cause a denial of service.
8) Use of Uninitialized Variable (CVE-ID: CVE-2026-45865)
CWE-ID: CWE-457 - Use of Uninitialized Variable
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to use of uninitialized memory in the mctp i2c event handler read path when handling i2c read requests to an mctp-i2c device. A local user can issue crafted i2c read operations to disclose sensitive information.
The issue was observed with certain i2c bus drivers returning a stack uninitialized byte value during reads.
9) Improper Initialization (CVE-ID: CVE-2026-45930)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper initialization in netlink ndmsg response messages when handling RTM_GETNEIGH requests. A local user can send a crafted netlink request to disclose sensitive information.
The issue affects pad bytes in the ndmsg data returned by the kernel.
10) NULL pointer dereference (CVE-ID: CVE-2026-46034)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in vfio_cdx_set_msi_trigger() when handling VFIO_DEVICE_SET_IRQS requests with VFIO_IRQ_SET_DATA_BOOL or VFIO_IRQ_SET_DATA_NONE before interrupts are configured through the EVENTFD path. A local user can call VFIO_DEVICE_SET_IRQS with those flags before setting up interrupts to cause a denial of service.
11) Race condition (CVE-ID: CVE-2026-53108)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in powerpc PMD huge page handling when unmapping memory during PMD page migration or device-private THP entry handling. A local user can trigger concurrent move_pages() and munmap() operations to cause a denial of service.
The issue can lead to a kernel BUG in pmdp_huge_get_and_clear_full() on powerpc/64s systems.
12) Improper access control (CVE-ID: CVE-2026-63830)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to modify the page cache contents.
The vulnerability exists due to improper access control in the sk_msg scatter-gather handling logic when processing SK_MSG transformations and BPF message helpers. A local user can trigger scatterlist entry transfers, shifts, splits, or copies that desynchronize sg.copy state to modify the page cache contents.
Exploitation requires the ability to reach a later SK_MSG verdict that exposes sg_virt(sge) as writable BPF ctx->data.
13) Uncontrolled Recursion (CVE-ID: CVE-2026-63983)
CWE-ID: CWE-674 - Uncontrolled Recursion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to uncontrolled recursion in netem packet duplication handling in the netem qdisc when processing duplicated packets through a qdisc tree containing another netem instance. A local user can trigger packet duplication to cause a denial of service.
Exploitation can exhaust stack or memory when packet duplication is enabled and duplicated packets are re-enqueued through another netem in the tree.
14) NULL pointer dereference (CVE-ID: CVE-2026-64012)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the sch_sfb packet scheduler when dequeuing packets from child qdiscs after a peek operation. A local user can trigger network traffic processing through a crafted qdisc hierarchy to cause a denial of service.
Exploitation requires the sfb scheduler to have child qdiscs whose peek callback uses qdisc_peek_dequeued().
15) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-64070)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in sysfs show() callbacks in arch/powerpc/perf/hv-gpci.c when handling repeated sysfs reads. A local user can repeatedly read the affected sysfs entries to cause a denial of service.
On CONFIG_PREEMPT=y kernels, repeated successful reads can leave preemption disabled and a subsequent user-mode page fault may be forced to SIGSEGV, with the resulting coredump triggering a kernel scheduling while atomic condition.
16) NULL pointer dereference (CVE-ID: CVE-2026-64116)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a NULL pointer dereference in ipv6_hop_ioam() when processing an IPv6 IOAM Hop-by-Hop option during concurrent interface teardown. A remote attacker can send a specially crafted packet to cause a denial of service.
The issue occurs because IPv6 interface state can be cleared concurrently through RCU, allowing __in6_dev_get(skb->dev) to return NULL while the packet is being handled.
17) Improper input validation (CVE-ID: CVE-2026-64280)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in afu_ioctl_dma_map() when handling a DFL_FPGA_PORT_DMA_MAP ioctl request with a user-supplied length. A local user can provide an excessively large length value to cause a denial of service.
18) Out-of-bounds read (CVE-ID: CVE-2026-64422)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.
Exploitation requires tcp_mtu_probing to be set to 2.
19) Use-after-free (CVE-ID: CVE-2026-64424)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in netpoll tx_work handling when shutting down netpoll while a pending TX worker runs in parallel with the cleanup path. A local user can trigger netpoll cleanup during concurrent worker execution to cause a denial of service.
The issue occurs because the queued worker can continue running after the associated netpoll data has been freed.
20) Improper locking (CVE-ID: CVE-2026-64428)
CWE-ID: CWE-667 - Improper Locking
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock type selection in the sch irq startup path when starting up a requested irq on PREEMPT_RT systems. A local user can request a threaded irq that reaches sch_irq_unmask() and sch_irq_mask_unmask() to cause a denial of service.
The issue occurs because the path is not sleepable, but a regular spinlock_t becomes a sleeping lock on PREEMPT_RT.
21) Improper resource shutdown or release (CVE-ID: CVE-2026-64461)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in the MediaTek PCIe controller driver when enabling a port fails during setup. A local user can trigger a port initialization failure to cause a denial of service.
The issue occurs in the probe error path after IRQ domains have already been created for the port.
22) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-68233)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper shutdown of a timer in vc4_bo_cache_destroy() in the vc4 BO cache when tearing down the BO cache. A local user can trigger the affected code path to cause a denial of service.
23) Infinite loop (CVE-ID: CVE-2026-68241)
CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper control of a loop in intel_dp_check_mst_status() in the i915 DisplayPort MST handling code when servicing sink-originated DP MST ESI interrupts. A local user can trigger repeated interrupt processing to cause a denial of service.
The issue can occur if the sink device remains stuck and does not clear incoming interrupts.
24) NULL pointer dereference (CVE-ID: CVE-2026-68242)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in execlists_create_virtual() in the i915 GPU driver when handling the ioctl path and sched_engine allocation fails. A local user can trigger sched_engine allocation failure through a crafted ioctl interaction to cause a denial of service.
25) Race condition (CVE-ID: CVE-2026-68323)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in tipc_udp_rcast_add() and cleanup_bearer() in net/tipc/udp_media.c when updating the udp bearer replicast list during peer discovery and bearer cleanup. A local user can enable a TIPC bearer from an unprivileged user namespace and trigger concurrent list updates to cause a denial of service.
The issue can corrupt the kernel list structure and trigger a kernel BUG during bearer cleanup.
26) Double free (CVE-ID: CVE-2026-72015)
CWE-ID: CWE-415 - Double Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to double free in RMID management in fs/resctrl/rdtgroup.c when unmounting and removing pseudo-locked resctrl groups. A local user can create a pseudo-locked group and trigger unmount processing to cause a denial of service.
The issue affects pseudo-locked groups whose RMID is freed during setup and then freed again during cleanup.
27) Improper resource shutdown or release (CVE-ID: CVE-2026-72040)
CWE-ID: CWE-404 - Improper Resource Shutdown or Release
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource shutdown or release in i_ipmi_request() in the IPMI message handler when handling a request with a caller-supplied recv_msg and an error occurs. A local user can trigger an error path using a supplied receive message to cause a denial of service.
The issue occurs because the reference count on the associated user object remains elevated on certain error paths.
28) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72041)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in espintcp_sendskmsg_locked in net/xfrm/espintcp.c when handling partial sends of sk_msg data. A local user can trigger partial send conditions to cause a denial of service.
29) Memory leak (CVE-ID: CVE-2026-72081)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in efct_dispatch_fcp_cmd() in the efct SCSI driver when processing an unsolicited FCP command with an unsupported additional CDB. A remote attacker can send a crafted FCP command to cause a denial of service.
30) Improper Initialization (CVE-ID: CVE-2026-72172)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to uninitialized memory in struct pages for ZONE_DEVICE in mm/mm_init.c when hot-plugging DAX memory into an unoccupied subsection of an early section. A local attacker can hot-plug crafted DAX memory to cause a denial of service.
The issue occurs because the unoptimized boot memmap is reused for early sections while only a reduced number of struct pages are initialized, leaving remaining tail struct pages uninitialized.
31) Out-of-bounds write (CVE-ID: CVE-2026-72212)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service or execute arbitrary code.
The vulnerability exists due to memory corruption in create_altmaps_and_memory_blocks() in mm/memory_hotplug.c when handling a failure after successful memory addition with memmap_on_memory enabled. A local user can trigger this error path to cause a denial of service or execute arbitrary code.
The issue occurs because vmemmap pages allocated from an altmap may be freed into the system buddy allocator before the physical linear mapping for that memory is destroyed.
32) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-72213)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource management in alloc_hugetlb_folio() when handling hugetlb cgroup reserved and non-reserved charges. A local user can trigger hugetlb folio allocation and later freeing to cause a denial of service.
The issue causes a page_counter underflow because the reserved charge path stores the wrong cgroup pointer in the folio and the reserved uncharge later decrements a counter that was never charged for that cgroup.
33) Observable discrepancy (CVE-ID: CVE-2026-72236)
CWE-ID: CWE-203 - Observable discrepancy
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper restriction of speculative execution in __hw_perf_event_init() in arch/s390/kernel/perf_cpum_cf.c when processing a user-controlled perf event configuration value as an array index. A local user can supply a crafted event->attr.config value to disclose sensitive information.
34) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-72301)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a time-of-check time-of-use flaw in sof_ipc3_bytes_put() when copying user-supplied control data. A local user can provide crafted control data with a different size than the previously stored buffer contents to cause a denial of service.
The copied length is derived from the old buffered size rather than the incoming size field.
35) Out-of-bounds read (CVE-ID: CVE-2026-72301)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in sof_ipc3_bytes_get() when handling crafted control data. A local user can provide crafted control data with an invalid size value to disclose sensitive information.
36) Improper Initialization (CVE-ID: CVE-2026-72305)
CWE-ID: CWE-665 - Improper Initialization
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to improper initialization in VDUSE bounce page allocation when mapping bounce pages to userspace. A local user can trigger bounce page mappings to disclose sensitive information.
37) Improper input validation (CVE-ID: CVE-2026-72319)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper input validation in ip_vs_in_icmp in the IPVS subsystem when processing ICMP error packets from tunnels. A remote attacker can send a specially crafted ICMP error packet to cause a denial of service.
The issue involves inner IP headers not being ensured in skb headroom after outer headers are stripped, and additional length checks were required for the inner headers.
38) Use-after-free (CVE-ID: CVE-2026-72493)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local attacker to cause a denial of service.
The vulnerability exists due to a race condition leading to use-after-free in enqueue_to_backlog() when processing packets during device unregistration. A local attacker can trigger packet transmission during device unregistration to cause a denial of service.
The issue occurs because a packet can escape backlog flushing during network namespace exit or similar device unregistration timing.
39) Out-of-bounds read (CVE-ID: CVE-2026-74312)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to out-of-bounds access in vhost_vdpa_mmap() and vhost_vdpa_fault() when processing a virtqueue index from vm_pgoff. A local user can provide an out-of-range queue index to trigger driver-specific get_vq_notification() callbacks and cause a denial of service.
The issue may lead to invalid PFN remaps in the callback path.
40) NULL pointer dereference (CVE-ID: CVE-2026-74379)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in dev_dax_kmem_remove() when removing dax kmem ranges after partial success during probing. A local user can trigger removal of a device with ranges whose resources were never added to cause a denial of service.
The issue occurs when dev_dax_kmem_probe() partially succeeds and later probe failures leave some range resources unset while removal still iterates over all ranges.
41) Improper input validation (CVE-ID: CVE-2026-74544)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper input validation in the cls_u32 packet classifier when processing a crafted filter configuration with varoffset enabled. A local user can supply an out-of-range offshift value to trigger shift-out-of-bounds behavior and cause a denial of service.
Exploitation is possible by an unprivileged user via user or network namespaces.
42) Race condition (CVE-ID: CVE-2026-74578)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose plaintext and compromise cryptographic operation integrity.
The vulnerability exists due to improper synchronization of shared cryptographic state in the AIO/async path in skcipher_recvmsg() when handling async skcipher receive operations. A local user can race an asynchronous skcipher receive operation with sendmsg(ALG_SET_IV) to disclose plaintext and compromise cryptographic operation integrity.
The described plaintext recovery applies to CTR/stream modes through IV/keystream reuse.
43) Use-after-free (CVE-ID: CVE-2026-74583)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.
The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.
44) Use-after-free (CVE-ID: CVE-2026-74587)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to use-after-free in the SCTP ASCONF handling code when processing a delayed authenticated ASCONF-ACK after peer restart handling purges the ASCONF queue. A remote attacker can send a delayed authenticated ASCONF-ACK to cause a denial of service.
The issue occurs because a cached ASCONF chunk pointer can remain dangling while the association is still alive during peer restart handling.
45) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-74611)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to overwrite memory in later caller iovecs beyond the returned length.
The vulnerability exists due to an improper iterator state restoration in tls_decrypt_sw() and the TLS 1.3 zero-copy retry path when processing a TLS 1.3 control record after optimistic zero-copy decryption. A remote attacker can send a specially crafted TLS record to overwrite memory in later caller iovecs beyond the returned length.
Exploitation requires the receiver to have TLS_RX_EXPECT_NO_PAD enabled.
46) Race condition (CVE-ID: CVE-2026-74614)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in virtio vsock worker handling in net/vmw_vsock/virtio_transport.c when processing virtqueue work across freeze and restore operations. A local user can trigger worker activity during suspend and restore state transitions to cause a denial of service.
The issue affects the RX, TX, and event workers when a delayed worker observes a replacement queue state while retaining a pointer to a deleted queue.
47) Always-Incorrect Control Flow Implementation (CVE-ID: CVE-2026-74653)
CWE-ID: CWE-670 - Always-Incorrect Control Flow Implementation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper handling of a stuck RX timeout condition in 8250_of for the LPC32xx UART when handling serial port interrupts. A local user can repeatedly open the front-panel serial port to cause a denial of service.
The issue can trigger a persistent interrupt storm that livelocks the CPU and trips the soft-lockup detector on affected single-core systems.
48) Out-of-bounds read (CVE-ID: CVE-2026-74723)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the btrfs lzo decompression logic when reading a crafted inline lzo compressed file extent from a crafted btrfs image. A local user can supply a crafted filesystem image containing an invalid inline extent header to cause a denial of service.
The issue is triggered when the inline extent contains only an lzo header without the required segment header or payload, and user interaction is required to access the crafted filesystem data.
49) Use-after-free (CVE-ID: CVE-2026-80579)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information, modify data, or cause a denial of service.
The vulnerability exists due to a use-after-free in the fbdev mode handling logic when processing FBIOPUT_VSCREENINFO requests with FB_ACTIVATE_INV_MODE. A local user can delete a videomode that is still referenced by fb_info->mode to disclose sensitive information, modify data, or cause a denial of service.
The stale pointer may later be dereferenced during sysfs mode reads through show_mode().
50) Incorrect calculation (CVE-ID: CVE-2026-80893)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt swap entry data.
The vulnerability exists due to improper handling of userfaultfd write-protection bits in copy_hugetlb_page_range() in mm/hugetlb.c when forking a process while a hugetlb migration entry is in flight or a hugetlb page is poisoned. A local user can fork a process under these conditions to corrupt swap entry data.
Userfaultfd does not need to be involved.
51) Use-after-free (CVE-ID: CVE-2026-80977)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt memory.
The vulnerability exists due to improper handling of shared zerocopy state in skb_tx_error() when processing cloned socket buffers. A remote attacker can trigger processing of cloned socket buffers to corrupt memory.
The issue can be reached when Open vSwitch processes a non-last OVS_ACTION_ATTR_RECIRC action, the clone encounters a flow miss, and a later local ESP delivery decrypts data in place.
52) Improper Validation of Specified Quantity in Input (CVE-ID: CVE-2026-89528)
CWE-ID: CWE-1284 - Improper Validation of Specified Quantity in Input
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to improper validation of cumulative Read segment lengths in the SVCRDMA Read list processing when processing a Read list containing multiple segments whose cumulative length exceeds the page budget. A remote attacker can send a crafted Read list to cause a denial of service.
53) Use-after-free (CVE-ID: CVE-2026-89669)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free condition.
The vulnerability exists due to a use-after-free in copy-notify state initialization when racing a crafted OFFLOAD_CANCEL request against COPY_NOTIFY processing. A remote attacker can send a crafted OFFLOAD_CANCEL request to trigger a use-after-free condition.
Exploitation requires a matching client ID and a guessable state object ID.
54) Incorrect calculation (CVE-ID: CVE-2026-89685)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a clock domain mismatch in the NFS server clients_still_reclaiming() function when sending CLAIM_PREVIOUS OPEN requests. A remote attacker can send CLAIM_PREVIOUS OPEN requests to cause a denial of service.
55) Improper handling of exceptional conditions (CVE-ID: CVE-2026-89706)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause copied data to be silently lost.
The vulnerability exists due to improper handling of writeback errors in the NFS server async COPY operation in _nfsd_copy_file_range() when processing an asynchronous COPY request whose writeback fails. A remote attacker can issue an asynchronous COPY request that encounters a writeback failure to cause copied data to be silently lost.
56) Out-of-bounds read (CVE-ID: CVE-2026-89778)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read memory out of bounds.
The vulnerability exists due to an out-of-bounds read in zisofs_fill_pages() when reading a compressed file on a mounted ISO9660 image containing a crafted ZF Rock Ridge record. A remote attacker can provide a crafted ISO9660 image to read memory out of bounds.
The issue is triggered when an empty zisofs block follows a sub-page block with a nonzero page offset.
57) Race condition (CVE-ID: CVE-2026-89811)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the AMD KFD MES queue management code when evicting or suspending MES queues while DMA descriptors are in flight. A local user can trigger queue eviction or suspension while in-flight DMA descriptors access unmapped memory to cause a denial of service.
The issue occurs during SVM page migration.
58) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-89987)
CWE-ID: CWE-664 - Improper control of a resource through its lifetime
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause silent data loss.
The vulnerability exists due to failure to propagate the PMD dirty bit in zap_huge_pmd_folio() when unmapping a PMD-mapped MAP_SHARED tmpfs mapping after data has been written through a read-faulted mapping. A local user can write data through a shared tmpfs mapping and unmap it to cause silent data loss.
Exploitation requires shmem transparent huge pages and swap to be enabled.
59) Out-of-bounds read (CVE-ID: CVE-2026-90011)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to disclose sensitive information and cause a denial of service.
The vulnerability exists due to an out-of-bounds read in the iSCSI target login payload buffer when processing a crafted login PDU without a terminating null byte. A remote attacker can send a crafted login PDU to disclose sensitive information and cause a denial of service.
Exploitation is reachable through the CHAP authentication path on a portal configured for CHAP.
60) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-90101)
CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an incorrectly specified function argument in the bnxt hardware monitoring event handler when handling hardware monitoring events. A local user can trigger the affected event handler to cause a denial of service.
61) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-90283)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause huge page reservations to remain charged.
The vulnerability exists due to improper resource cleanup in the hugetlbfs_fill_super() failure path when initiating a hugetlbfs mount with size or min_size options and root dentry creation fails. A local user can trigger the mount failure path to cause huge page reservations to remain charged.
62) Off-by-one (CVE-ID: CVE-2026-90289)
CWE-ID: CWE-193 - Off-by-one Error
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an out-of-bounds memory access.
The vulnerability exists due to an off-by-one error in the AMDGPU display manager HDCP per-connector arrays when handling a 32nd display connector. A local user can cause the HDCP code to process a 32nd connector to cause an out-of-bounds memory access.
63) Improper access control (CVE-ID: CVE-2026-90315)
CWE-ID: CWE-284 - Improper Access Control
CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to bypass kernel lockdown PCI access restrictions.
The vulnerability exists due to improper access control in the legacy PCI sysfs I/O and memory handlers when accessing legacy I/O and memory spaces while the kernel is locked down. A local privileged user can write arbitrary I/O ports and map legacy I/O and memory spaces to bypass kernel lockdown PCI access restrictions.
64) Race condition (CVE-ID: CVE-2026-90430)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the Tegra241 CMDQV LVCMDQ initialization and error-handling logic when an error interrupt is handled while an LVCMDQ is being initialized. A local user can cause an LVCMDQ error to be handled during initialization to cause a denial of service.
The condition can occur when an LVCMDQ error is inherited across a kexec.
65) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-92488)
CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper resource cleanup in the ERDMA RDMA object destruction functions when a destroy command fails. A local user can destroy an RDMA object after a command failure to cause a denial of service.
A command timeout permanently disables the command queue, preventing retries.
66) Use-after-free (CVE-ID: CVE-2026-93134)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access freed memory.
The vulnerability exists due to use-after-free in console_flush_one_record() when emitting records through legacy printing during a console handover. A local user can trigger legacy record emission during a console handover to access freed memory.
67) Exposure of Resource to Wrong Sphere (CVE-ID: CVE-2026-93222)
CWE-ID: CWE-668 - Exposure of resource to wrong sphere
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause signal sender identifiers to be incorrectly rewritten.
The vulnerability exists due to improper handling of shared siginfo data in the signal delivery logic when delivering group signals across namespaces. A local user can send a group signal to cause sender identifiers rewritten for one recipient to affect subsequent recipients.
68) Deadlock (CVE-ID: CVE-2026-93252)
CWE-ID: CWE-833 - Deadlock
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper lock ordering in the OCFS2 ACL initialization and extended attribute handling paths when concurrently performing extended attribute updates and filesystem node-creation operations. A local user can perform concurrent extended attribute updates and mkdir or mknod operations to cause a denial of service.
Exploitation depends on a pending writer on the journal transaction barrier causing the conflicting lock acquisition paths to block.
69) Out-of-bounds read (CVE-ID: CVE-2026-93787)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause an out-of-bounds read.
The vulnerability exists due to improper bounds checking in cifs_filldir() when processing SMB1 TRANS2 directory enumeration responses. A remote attacker can return a directory entry with an oversized FileNameLength to cause an out-of-bounds read.
User interaction is required to list a directory on a CIFS mount served by an attacker-controlled SMB1 server.
70) Use-after-free (CVE-ID: CVE-2026-93800)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the btrfs relocation root cleanup logic when handling errors returned by btrfs_update_reloc_root() during relocation. A local user can trigger relocation that encounters an error and unmount the filesystem to cause a denial of service.
71) Out-of-bounds read (CVE-ID: CVE-2026-93806)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read out-of-bounds memory.
The vulnerability exists due to an out-of-bounds read in cfg80211_rx_assoc_resp() in the cfg80211 wireless subsystem when processing a short association response frame. A remote attacker can send a malformed association response frame to read out-of-bounds memory.
72) Use-after-free (CVE-ID: CVE-2026-93820)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free race condition in Rockchip PCIe host controller root bus removal when rescan or hotplug operations are triggered concurrently via sysfs. A local user can race root bus removal with concurrent rescan or hotplug operations to cause a denial of service.
73) Race condition (CVE-ID: CVE-2026-93821)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in the Altera PCIe controller driver's root bus removal routine when concurrent rescan or hotplug operations are triggered through sysfs. A local user can trigger concurrent rescan or hotplug operations through sysfs to cause a denial of service.
74) Use-after-free (CVE-ID: CVE-2026-93822)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a system crash.
The vulnerability exists due to a race condition in PCI iProc root bus removal when concurrently triggering sysfs rescan or hotplug operations. A local user can trigger concurrent sysfs rescan or hotplug operations to cause a system crash.
75) Out-of-bounds write (CVE-ID: CVE-2026-97415)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to perform an out-of-bounds write.
The vulnerability exists due to improper validation of root reference name lengths in Btrfs ROOT_REF and ROOT_BACKREF item handling when processing malformed Btrfs root reference items. A local user can invoke BTRFS_IOC_GET_SUBVOL_INFO on a filesystem containing a malformed ROOT_BACKREF item to perform an out-of-bounds write.
76) NULL pointer dereference (CVE-ID: CVE-2026-97416)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a null pointer dereference in btrfs_may_alloc_data_chunk() when processing corrupted Btrfs metadata during a balance operation. A local user can trigger a Btrfs balance operation on a filesystem whose chunk tree contains a chunk without a corresponding block group to cause a denial of service.
The issue occurs when CONFIG_BTRFS_ASSERT is disabled.
77) Resource exhaustion (CVE-ID: CVE-2026-97491)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper synchronization in rds_ib_conn_path_shutdown when tearing down InfiniBand network configurations. A local user can initiate teardown of InfiniBand network configurations to cause a denial of service.
78) Heap-based buffer overflow (CVE-ID: CVE-2026-97555)
CWE-ID: CWE-122 - Heap-based Buffer Overflow
CVSSv4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to execute arbitrary code.
The vulnerability exists due to a heap-based buffer overflow in the SMB client DACL owner/group rewrite logic when rewriting an existing DACL containing short SIDs with replacement owner or group SIDs obtained through a cifs.idmap upcall. A remote attacker can cause rewritten access control entries to exceed the allocated buffer to execute arbitrary code.
User interaction is required.
79) Missing Authorization (CVE-ID: CVE-2026-97564)
CWE-ID: CWE-862 - Missing Authorization
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a root usermodehelper to process unvetted authority-bearing fields.
The vulnerability exists due to missing authorization validation in cifs.idmap key description handling when invoking request_key(2) with a non-NULL callout. A local user can supply a cifs.idmap key description containing authority-bearing fields to cause a root usermodehelper to process unvetted authority-bearing fields.
80) Unchecked Return Value (CVE-ID: CVE-2026-97571)
CWE-ID: CWE-252 - Unchecked Return Value
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause the device to use a zero DMA address.
The vulnerability exists due to an unchecked return value in bnxt_queue_mem_alloc() when allocating TPA buffer information. A local user can trigger a TPA buffer allocation failure to cause the device to use a zero DMA address.
An uninitialized rx_tpa[] slot must be selected by the hardware.
81) Use-after-free (CVE-ID: CVE-2026-97574)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 1.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local privileged user to cause a denial of service.
The vulnerability exists due to use-after-free in the bnxt_en RX ring TPA state handling when a queue restart encounters an allocation failure. A local privileged user can trigger a queue restart that encounters an allocation failure to cause a denial of service.
82) Use-after-free (CVE-ID: CVE-2026-97595)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 7.7 [CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause memory corruption.
The vulnerability exists due to use-after-free in mac802154 queued RX frame workers when processing received beacon and MAC-command frames during interface removal. A remote attacker can send MAC-command frames while an interface is removed to cause memory corruption.
83) Incorrect calculation (CVE-ID: CVE-2026-97945)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause data loss.
The vulnerability exists due to incorrect preservation of the dirty bit in pmd_modify() when changing memory protections on PMD-mapped transparent huge pages. A local user can use MADV_FREE and change memory protections under memory pressure to cause data loss.
NUMA hinting can also trigger the issue.
84) Resource exhaustion (CVE-ID: CVE-2026-98010)
CWE-ID: CWE-400 - Resource exhaustion
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to improper validation of DRR quantum values in drr_change_class() when configuring DRR qdisc classes with a low quantum value. A local user can configure a DRR qdisc class with the quantum set to 1 to cause a denial of service.
Exploitation requires CONFIG_NET_SCH_DRR=y and CAP_NET_ADMIN; the capability can be namespace-local through unshare -Urn.
85) Use-after-free (CVE-ID: CVE-2026-98015)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access freed memory.
The vulnerability exists due to use-after-free in mlx5_eswitch_termtbl_put when two callers concurrently release the same mlx5_termtbl_handle. A local user can invoke concurrent calls on the same handle to access freed memory.
86) Use-after-free (CVE-ID: CVE-2026-98016)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to access freed memory.
The vulnerability exists due to a use-after-free race in sample_restore_put() when concurrently tearing down TC sample rules sharing the same restore context. A local user can concurrently tear down shared TC sample rules to access freed memory.
87) Out-of-bounds read (CVE-ID: CVE-2026-98077)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 0 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger an out-of-bounds read.
The vulnerability exists due to an out-of-bounds read in sip_skip_whitespace() in nf_conntrack_sip when processing a SIP payload containing a recognized header name followed by whitespace at the end of the payload. A remote attacker can send such a crafted SIP payload to trigger an out-of-bounds read.
88) Out-of-bounds read (CVE-ID: CVE-2026-98089)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to read out-of-bounds memory.
The vulnerability exists due to an uninitialized transport header offset causing an out-of-bounds read in alb_determine_nd() in the bonding driver when inspecting ICMPv6 headers in IPv6 packets on bonding transmit paths. A remote attacker can send an IPv6 packet that is processed through a bonding transmit path to read out-of-bounds memory.
The affected paths include packets sent through AF_PACKET or raw sockets and forwarded packets.
89) Time-of-check Time-of-use (TOCTOU) Race Condition (CVE-ID: CVE-2026-98130)
CWE-ID: CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to trigger a use-after-free.
The vulnerability exists due to a time-of-check to time-of-use race condition in the SCTP_CMD_TIMER_START handler when processing SCTP timer start commands. A remote attacker can trigger the race condition to trigger a use-after-free.
90) Use-after-free (CVE-ID: CVE-2026-98173)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger accesses to freed kernel memory.
The vulnerability exists due to use-after-free in cifs_try_adding_channels() when adding SMB channels concurrently with a server interface refresh. A local user can trigger overlapping channel addition and interface refresh operations to trigger accesses to freed kernel memory.
91) Function Call with Incorrectly Specified Arguments (CVE-ID: CVE-2026-98216)
CWE-ID: CWE-628 - Function Call with Incorrectly Specified Arguments
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to incorrectly specified DMA mapping arguments in the PIO_CRED case of hfi1_file_mmap() when selecting a credit-return page with an offset buffer address and a zero page offset. A local user can map the wrong credit-return page and initiate transfers using send PIO to cause a denial of service.
For an IOMMU-backed, virtually mapped allocation, the issue affects contexts whose credit-return entries reside on the second or third page. Transfers using send PIO stall indefinitely, while send-DMA-only transfers remain operational.
92) Incorrect Pointer Scaling (CVE-ID: CVE-2026-98216)
CWE-ID: CWE-468 - Incorrect Pointer Scaling
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to incorrect pointer scaling in the PIO_CRED case of hfi1_file_mmap() when mapping a credit-return page using a byte offset added to a struct credit_return pointer. A local user can map and read the affected credit-return page to cause a denial of service.
The erroneous offset occurs when the hardware send context index reaches 64 or 128. With IOMMU translation, the resulting mapping installs an invalid page-table entry, and the first user-space read triggers a kernel Oops.
93) Out-of-bounds write (CVE-ID: CVE-2026-98248)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt adjacent memory.
The vulnerability exists due to out-of-bounds reads and writes caused by an omitted instruction size suffix in the arm64 per-CPU atomic operations when performing 8-bit or 16-bit operations using LSE instructions. A local user can invoke the affected operations to corrupt adjacent memory.
94) Race condition (CVE-ID: CVE-2026-98252)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 7.3 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to compromise system confidentiality, integrity, and availability.
The vulnerability exists due to a race condition in reference count initialization in iwpm_get_nlmsg_request() in the Linux kernel RDMA core when publishing a request to a global list before initializing its reference count. A local user can trigger concurrent access to the incompletely initialized request to compromise system confidentiality, integrity, and availability.
95) Use-after-free (CVE-ID: CVE-2026-98253)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free in the kernel.
The vulnerability exists due to a use-after-free in ucma_process_join() in the RDMA/ucma subsystem when handling concurrent multicast joins and a copy_to_user() failure. A local user can issue concurrent JOIN_MCAST calls for the same address and trigger a response-copy failure to trigger a use-after-free in the kernel.
Multicast leave operations match entries by socket address and destroy the first matching entry. This can cancel the newer RoCE work while an older worker still references the freed ucma_multicast object.
96) Use-after-free (CVE-ID: CVE-2026-98260)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in POSIX CPU timer cleanup during process execution and termination when a non-leader thread executes a program and a subsequent failure leaves a freed timer node queued. A local user can create and arm a per-thread CPU timer and trigger an execution failure after the thread ID exchange, followed by task reaping, to cause a denial of service.
The affected timer functionality requires CONFIG_POSIX_TIMERS to be enabled.
97) Improper handling of exceptional conditions (CVE-ID: CVE-2026-98269)
CWE-ID: CWE-755 - Improper Handling of Exceptional Conditions
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause persistent filesystem inconsistencies.
The vulnerability exists due to improper handling of inode update failures in btrfs_replace_file_extents() when performing hole punching or reflinking. A local user can perform hole punching or reflinking operations that encounter an inode update failure to cause persistent filesystem inconsistencies.
Exploitation requires the transaction to be committed after the inode update failure.
98) Incorrect calculation (CVE-ID: CVE-2026-98273)
CWE-ID: CWE-682 - Incorrect Calculation
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to an incorrect exception return address calculation in int3_emulate_call() in the x86 kprobes implementation when emulating a six-byte CS-prefixed CALL instruction using an assumed five-byte instruction length. A local user can use eBPF to probe a CS-prefixed CALL instruction within a kernel function to cause a denial of service.
99) Out-of-bounds write (CVE-ID: CVE-2026-98323)
CWE-ID: CWE-787 - Out-of-bounds write
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt receive-state memory.
The vulnerability exists due to an out-of-bounds write in the Linux kernel RDMA/siw siw_get_hdr() function when receiving an extended DDP/RDMAP header across multiple TCP callbacks. A remote attacker can send a fragmented extended DDP/RDMAP header to corrupt receive-state memory.
100) Race condition (CVE-ID: CVE-2026-98347)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a race condition in the Linux kernel IPoIB interface state handling when a light multicast flush overlaps with interface shutdown. A local user can bring an IPoIB interface down during a multicast flush to cause a denial of service by leaving IPOIB_FLAG_OPER_UP set after shutdown, resulting in endless workqueue retries and an interface teardown deadlock.
101) Race condition (CVE-ID: CVE-2026-98352)
CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a shared completion queue credit leak.
The vulnerability exists due to a race condition in the Linux kernel RDMA RTRS client when handling address resolution concurrently with connection teardown after an interrupted connection attempt. A local user can interrupt a connection attempt while the address resolution handler races with teardown to cause a shared completion queue credit leak.
Subsequent RDMA device unregistration triggers a kernel warning in ib_cq_pool_cleanup() if completion queue credits remain allocated.
102) Memory leak (CVE-ID: CVE-2026-98354)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service through memory exhaustion.
The vulnerability exists due to a receive buffer memory leak in ib_mad_complete_recv() in the RDMA MAD subsystem when processing management datagrams that fail PKey enforcement. A remote attacker can repeatedly send management datagrams with an incorrect PKey to cause a denial of service through memory exhaustion.
Each rejected datagram leaks approximately 300 bytes for an InfiniBand port or approximately 2 KB for OPA.
103) Use-after-free (CVE-ID: CVE-2026-98357)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.
The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.
104) NULL pointer dereference (CVE-ID: CVE-2026-98358)
CWE-ID: CWE-476 - NULL Pointer Dereference
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a null pointer dereference in the iSER initiator's iser_check_remote_inv() and iser_inv_desc() functions when processing remote invalidations for unregistered data directions. A remote attacker can respond to a write command with IB_WR_SEND_WITH_INV to cause a denial of service.
The triggering write command sends all of its data as immediate data. Exploitation requires control of the target responding to the initiator.
105) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98359)
CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause an RDMA port query to operate on an unregistered and uninitialized network device.
The vulnerability exists due to a missing registration-state check in ib_get_eth_speed() when processing asynchronous RDMA port queries during network device unregistration. A local user can trigger an asynchronous RDMA port query to cause an RDMA port query to operate on an unregistered and uninitialized network device.
The reference returned by ib_device_get_netdev() keeps the network device structure allocated but does not ensure that the device remains operational. The ethtool callback can be invoked after NETDEV_UNREGISTER and ndo_uninit have completed.
106) Use-after-free (CVE-ID: CVE-2026-98360)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to trigger a use-after-free in the kernel.
The vulnerability exists due to a use-after-free in the RDMA/rxe multicast-group handling code when a failed multicast-address operation frees a group that remains published in the multicast-group tree. A local user can request a subsequent attachment to the same multicast group to trigger a use-after-free in the kernel.
This path is reachable through ATTACH_MCAST on a UD queue pair. The initial rxe_mcast_add() failure can occur when the backing network device has been removed or dev_mc_add() returns an error.
107) Integer overflow (CVE-ID: CVE-2026-98365)
CWE-ID: CWE-190 - Integer overflow
CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to integer overflow in the Linux kernel RDMA/rxe mr_check_range() function when validating memory ranges supplied in RDMA read or write requests. A remote attacker can send a specially crafted RDMA request whose address and length cause arithmetic wraparound, bypassing the range check and triggering an out-of-bounds read or write and a kernel oops to cause a denial of service.
108) Use-after-free (CVE-ID: CVE-2026-98366)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to use-after-free in the Linux kernel RDMA/rxe memory registration and cleanup code when re-registering a memory region with both protection-domain and access changes and unsupported access flags. A local user can trigger a failed re-registration followed by memory-region deregistration, protection-domain deallocation, and memory-window cleanup to cause a denial of service.
109) Use-after-free (CVE-ID: CVE-2026-98367)
CWE-ID: CWE-416 - Use After Free
CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to use-after-free in the RDMA/siw siw_accept() function when cleaning up after a failed siw_qp_modify() call. A local user can trigger a concurrent queue pair transition to the error state to corrupt kernel memory.
Exploitation requires the concurrent transition to occur after the queue pair state lock is released but before connection endpoint cleanup completes.
110) Improper input validation (CVE-ID: CVE-2026-99999)
CWE-ID: CWE-20 - Improper input validation
CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to corrupt IPv4 packet headers and potentially compromise system confidentiality, integrity, and availability.
The vulnerability exists due to improper validation of the checksum start offset in the Linux kernel IPv4 checksum-completion paths when processing packets with invalid checksum metadata. A remote attacker can introduce a packet whose checksum start offset precedes the end of its IPv4 header into an affected processing path to cause skb_checksum_help to corrupt the network header, potentially compromising system confidentiality, integrity, and availability.
Remediation
Install update from vendor's website.