A vulnerability in the Linux kernel's net/sched subsystem (sch_hfsc) could cause a queueing discipline (qdisc) to stall. This happens because a class can be made passive twice during packet dequeue operations, leading to incorrect internal state and preventing further packet dequeues. The issue has been fixed by ensuring that a class is only made passive once during these operations.
A critical vulnerability in the Linux kernel's netfilter ipset subsystem involves improper use of the test_bit() function in lockless RCU readers for hash types. The issue arises because test_bit() is a relaxed atomic operation without memory barrier guarantees, which can lead to race conditions. The vulnerability has been fixed by replacing test_bit() with test_bit_acquire() in affected code paths. Multiple Linux kernel versions, including specific linux-aws builds, are affected. The flaw has a CVSS score of 9.8, indicating high severity with potential for complete system compromise. Official patches are available in several fixed kernel versions.
CVE-2026-72421 is a critical vulnerability in the Linux kernel's IPv4 routing subsystem. It occurs when CONFIG_IP_MULTIPLE_TABLES is enabled but no routing rule is added, causing fib_lookup() to improperly handle error routes in the local and main routing tables. This can lead to inconsistent routing behavior where an error route is overwritten by a default route. The issue has been fixed in Linux kernel versions starting from 5.15.0-1117.124~20.04.1 and similar patched releases.
A critical use-after-free vulnerability was identified and fixed in the Linux kernel's fbnic network driver. The flaw involves improper caching of shared info pointers across skb (socket buffer) reallocations in the fbnic_tx_lso() function, leading to a kernel slab-use-after-free error. This could allow an attacker to cause memory corruption with potential full system compromise. The issue affects multiple Linux kernel versions prior to 7.0.0 and specific earlier versions listed. A patch is available and included in Linux kernel 7.0.0 and later releases.
A vulnerability in the Linux kernel's drm/xe/pf subsystem was fixed to prevent processing of FAST_REQ or EVENT relay messages. The PF (Physical Function) should not handle these message types as they are not part of the defined VF/PF relay actions, which only use regular REQUEST messages. Processing these messages could break the VFPF ABI protocol and potentially trigger an assertion failure on the PF side.
A vulnerability in the Linux kernel's net: fib_rules subsystem was resolved. The issue involved the dumping of a dying fib_rule in fib_rules_dump(), where a function call could improperly increment a reference count on an object that was in the process of being deleted. This could lead to system instability or compromise. The vulnerability affects specific linux-azure kernel versions and has been assigned CVE-2026-74288 with a CVSS score of 7.8. A patch is available to address this issue.
A use-after-free vulnerability in the Linux kernel's IPv4 fib subsystem was resolved. The issue involved unsafe reference counting during fib_info dumping under RCU, potentially leading to memory corruption. This flaw affected specific Linux Azure kernel versions and was addressed by ensuring the lifetime of fib_info in fib_leaf_notify(). The vulnerability has a CVSS score of 7.8, indicating a high impact on confidentiality, integrity, and availability. A patch is available and should be applied to affected versions.
A use-after-free vulnerability in the Linux kernel's configfs_lookup() function was resolved. The issue occurs because the ->s_dentry pointer is left dangling on inode allocation failure, leading to potential dereferencing of freed memory during directory reads. This flaw has existed since 2006 and affects specific Linux kernel versions. The vulnerability has been patched.
A vulnerability in the Linux kernel's rxrpc subsystem involving improper handling of out-of-band (OOB) messages with MSG_PEEK has been resolved. The flaw allowed a peeked OOB message to be moved onto a pending queue without proper unlinking, causing memory corruption and use-after-free conditions. This could lead to system instability or compromise. The issue affects specific Linux kernel versions and has been addressed by official patches.
A critical vulnerability in the Linux kernel's KVM subsystem for arm64 architecture involves improper handling of guest VNCR memory attributes. The kernel unconditionally uses cacheable memory attributes even when the underlying page frame number (PFN) is not normal memory, which can cause system errors. This flaw has been fixed in Linux kernel versions 7.0.0 and later.
A vulnerability in the Linux kernel's netfilter nft_set_pipapo component could cause out-of-bounds writes due to improper handling of cloned nft_pipapo_match structures on memory allocation failure. This flaw allows a bad clone to leak into subsequent transactions, potentially leading to memory corruption. The issue has been fixed in multiple Linux kernel versions.
CVE-2026-72099 is a high-severity vulnerability in the Linux kernel's dm-integrity subsystem where the hash_offset variable is incorrectly incremented twice, leading to potential integrity issues. This flaw has been fixed in multiple Linux kernel versions starting from 6.8.0-147.147 and others. The vulnerability does not affect confidentiality but can impact integrity and availability. No known exploits are reported in the wild. A patch is available and should be applied to affected systems.
A vulnerability in the Linux kernel's macsec_encrypt() function could cause a 12-byte heap out-of-bounds read when the MAC header is unset on the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path. This flaw leads to reading memory out of bounds and leaking data as part of the Ethernet frame's outer source/destination MAC address. The issue has been fixed in specific Linux kernel versions.