CVE-2026-74700

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

7.8 HighFix available

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Another challenge with unlocked filters. There is a short window in tc_new_tfilter where a tcf_proto can be found and briefly referenced by a totally unrelated, unlocked classifier's request and cause a race.

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

Flower then hits the kind mismatch check (because it requested for kind "flower" but tp->ops->kind is "u32") and goes through the errout path which calls tcf_proto_put() on u32_tp. If the u32 thread has already gone through its own errout (its change() call failed on the PoC's empty options) and dropped its create and insert refs, flower's put is the last one and drops u32_tp's refcnt to zero.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

To explain why I used a temp variable "not_lockless" I'd like to point to a semi-related note on rtnl_held vs TCF_PROTO_OPS_DOIT_UNLOCKED (adding here for future cleanup if deemed necessary): The rtnl_held parameter and the TCF_PROTO_OPS_DOIT_UNLOCKED flag are redundant sources of truth for whether rtnl_lock is held. Among the nine classifier destroy(..rtnl_held..) callbacks, only flower consults the rtnl_held parameter which it propagates to tc_setup_cb_destroy() and tc_setup_cb_call(). The other eight (u32, flow, bpf, cgroup, route, basic, fw, mall) ignore it entirely;-> those that call tc_setup_cb_destroy() (u32, bpf, mall) hardcode true always instead of forwarding the parameter.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Attack profile

How easy it is to exploit

Attack vector: Local
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.13%Down 0.1 points since Aug 23, 2026

What each source reports

CVE List Score used 7.8

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: CVE-2026-74700
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

EUVDEUVD-2026-64387 7.8

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: EUVD-2026-64387
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-696w-35hf-m34q 7.8

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always...

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: GHSA-696w-35hf-m34q
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

NVD 7.8

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: CVE-2026-74700
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVBELL-CVE-2026-74700 7.8

Record: BELL-CVE-2026-74700
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-04

OSV 7.8

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: CVE-2026-74700
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 29 moreShow less

OSVDEBIAN-CVE-2026-74700 7.8

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers Another challenge with unlocked filters. There is a short window in tc_new_tfilter where a tcf_proto can be found and briefly referenced by a totally unrelated, unlocked classifier's request and cause a race. Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio: 1. Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock 2. u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain 3. flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller. Flower then hits the kind mismatch check (because it requested for kind "flower" but tp->ops->kind is "u32") and goes through the errout path which calls tcf_proto_put() on u32_tp. If the u32 thread has already gone through its own errout (its change() call failed on the PoC's empty options) and dropped its create and insert refs, flower's put is the last one and drops u32_tp's refcnt to zero. At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC): [ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524 Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378) Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378) Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459) Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held. To explain why I used a temp variable "not_lockless" I'd like to point to a semi-related note on rtnl_held vs TCF_PROTO_OPS_DOIT_UNLOCKED (adding here for future cleanup if deemed necessary): The rtnl_held parameter and the TCF_PROTO_OPS_DOIT_UNLOCKED flag are redundant sources of truth for whether rtnl_lock is held. Among the nine classifier destroy(..rtnl_held..) callbacks, only flower consults the rtnl_held parameter which it propagates to tc_setup_cb_destroy() and tc_setup_cb_call(). The other eight (u32, flow, bpf, cgroup, route, basic, fw, mall) ignore it entirely;-> those that call tc_setup_cb_destroy() (u32, bpf, mall) hardcode true always instead of forwarding the parameter. A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: DEBIAN-CVE-2026-74700
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2026-74700 7.3

Record: UBUNTU-CVE-2026-74700
CVSS 4.0: 7.3 HighCVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-06

OSVAZL-97244 No score

CVE-2026-74700 affecting package kernel for versions less than 6.6.152.1-1

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers

Feng created a poc which created this race with two threads, one creating a u32 filter and other a flower filter in the same chain/prio:

Both threads enter tc_new_tfilter, both find the chain empty, both drop filter_chain_lock
u32 finishes tcf_proto_create("u32") first, calls tcf_chain_tp_insert_unique() -> inserts u32_tp into the chain
flower finishes tcf_proto_create("flower") later, calls tcf_chain_tp_insert_unique() -> tcf_chain_tp_find() now sees u32_tp already there, takes a reference on it, destroys flower's own tp_new and returns u32_tp to the caller.

At this point tp->ops->destroy() runs in a context that never took rtnl_lock. When that happens, it might cause a UAF like the following (illustrated by the PoC):

[ +0.000710] BUG: KASAN: slab-use-after-free in u32_init (net/sched/cls_u32.c:393) [ +0.000281] Read of size 8 at addr ffff888120022f00 by task poc_feng_xue/524

Call Trace: u32_init (net/sched/cls_u32.c:393) tc_new_tfilter (net/sched/cls_api.c:2378)

Allocated by task 526: u32_init (net/sched/cls_u32.c:378) tc_new_tfilter (net/sched/cls_api.c:2378)

Freed by task 522: kfree u32_destroy (net/sched/cls_u32.c:662) tcf_proto_destroy (net/sched/cls_api.c:446) tcf_proto_put (net/sched/cls_api.c:459) tc_new_tfilter (net/sched/cls_api.c:2459)

Fix this by having tcf_proto_destroy() take rtnl_lock around tp->ops->destroy() for locked classifiers whenever rtnl is not held.

A future cleanup should remove the rtnl_held parameter from the destroy callback signature entirely and have callers rely solely on their knowledge whether they are running in an unlocked context.

Record: AZL-97244
Updated: 2026-11-02

OSVCLSA-2026-1789141176 No score

kernel: Fix of 131 CVEs

net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
USB: legousbtower: fix use-after-free on disconnect race {CVE-2026-64340}
udf: validate sparing table length as an entry count, not a byte count {CVE-2026-64322}
ipv4: igmp: remove multicast group from hash table on device destruction {CVE-2026-64423}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
USB: idmouse: fix use-after-free on disconnect race {CVE-2026-64344}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
netfilter: ebt_nflog: pin the NFLOG backend {CVE-2026-74660}
ipv4: fix use-after-free in fib_nhc_update_mtu() {CVE-2026-74656}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ipv6: prevent in6_dev_get() from resurrecting inet6_dev {CVE-2026-74630}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
ip6_tunnel: clear skb2->cb[] in ip6ip6_err() {CVE-2026-74597}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
sctp: keep chunk->transport in step with the list it is queued on {CVE-2026-74588}
netfilter: nf_tables: make nft_object rhltable per table {CVE-2026-74565}
scsi: scsi_debug: Fix REPORT ZONES alloc_len underflow OOB write {CVE-2026-74470}
nfs: use nfsi->rwsem to protect traversal of the file lock list {CVE-2026-72472}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
sctp: fix use-after-free of cached ASCONF chunk {CVE-2026-74587}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
ALSA: usb-audio: fix OOB write on Type II inbound URBs {CVE-2026-74682}
sctp: clear control chunk transport if it is being removed {CVE-2026-74688}
udp: fix potential use-after-free in tunnel segmentation {CVE-2026-74705}
bpf: Preserve pointer state for commuted arithmetic {CVE-2026-74720}
RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
libceph: Avoid using invalid osd indices from primary_temp {CVE-2026-80558}
drm/i915: Fix potential UAF in TTM object purge {CVE-2026-63884}
wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request {CVE-2026-68363}
ceph: fix pre-auth out-of-bounds read on snaptrace in ceph_handle_caps() {CVE-2026-68160}
libceph: Reject monmaps advertising zero monitors {CVE-2026-68155}
sctp: fix auth_hmacs array size in struct sctp_cookie {CVE-2026-68376}
Bluetooth: hci_sync: Protect UUID list traversal {CVE-2026-68189}
net: slip: serialize receive against buffer reallocation {CVE-2026-68143}
libceph: remove debugfs files before client teardown {CVE-2026-68153}
media: rtl2832: fix use-after-free in rtl2832_remove() {CVE-2026-68214}
sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid {CVE-2026-68320}
drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
pppoe: reload header pointer after dev_hard_header() {CVE-2026-68121}
libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() {CVE-2026-74499}
fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
net_sched: red: fix a race in __red_change() {CVE-2025-38108}
iio: event: Fix event FIFO reset race {CVE-2026-64496}
netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
openvswitch: fix GSO userspace truncation underflow {CVE-2026-68123}
media: cx23885: add ioremap return check and cleanup {CVE-2026-68226}
tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev {CVE-2026-68176} -…

Record: CLSA-2026-1789141176
Updated: 2026-11-02

OSVCLSA-2026-1789898700 No score

kernel: Fix of 163 CVEs

drm/amdgpu/sdma6.0: replace BUG_ON() with WARN_ON() {CVE-2026-68251}
amd/amdkfd: sync all devices to wait all processes being evicted {CVE-2024-36949}
Drivers: hv: vmbus: Don't free ring buffers that couldn't be re-encrypted {CVE-2024-36909}
Drivers: hv: vmbus: Track decrypted status in vmbus_gpadl {CVE-2024-36912}
xfs: save ailp before dropping the AIL lock in push callbacks {CVE-2026-31454}
net: qrtr: replace qrtr_tx_flow radix_tree with xarray to fix memory leak {CVE-2026-43041}
netfilter: nf_conntrack: destroy stale expectfn expectations on unregister {CVE-2026-53349}
cifs: avoid NULL pointer dereference in dbg call {CVE-2025-37844}
fs/notify: call exportfs_encode_fid with s_umount {CVE-2025-40237}
cifs: fix potential oops in cifs_oplock_break {CVE-2023-54258}
pstore/ram: fix buffer overflow in persistent_ram_save_old() {CVE-2026-46253}
Bluetooth: ISO: fix iso_conn related locking and validity issues {CVE-2023-54164}
netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets {CVE-2026-45873}
ext4: always drain queued discard work in ext4_mb_release() {CVE-2026-43065}
ipvs: Defer ip_vs_ftp unregister during netns cleanup {CVE-2025-40018}
Bluetooth: MGMT: Fix memory leak in set_ssp_complete {CVE-2026-23151}
sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto {CVE-2025-40281}
fscache: Use wait_on_bit() to wait for the freeing of relinquished volume {CVE-2023-52982}
libceph: prevent potential out-of-bounds reads in process_message_header() {CVE-2026-43406}
netfilter: nf_tables: reject immediate NF_QUEUE verdict {CVE-2026-43024}
ext4: add i_data_sem protection in ext4_destroy_inline_data_nolock() {CVE-2025-68261}
bpf, sockmap: Fix af_unix iter deadlock {CVE-2026-53035}
sctp: stream: fully roll back denied add-stream state {CVE-2026-52929}
netfilter: xt_CT: drop pending enqueued packets on template removal {CVE-2026-23391}
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp() {CVE-2026-23457}
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() {CVE-2026-43407}
af_unix: read UNIX_DIAG_VFS data under unix_state_lock {CVE-2026-31673}
jbd2: avoid bug_on in jbd2_journal_get_create_access() when file system corrupted {CVE-2025-68337}
Bluetooth: Fix NULL pointer deference on eir_get_service_data {CVE-2025-38304}
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption {CVE-2026-31533}
fsnotify: do not generate ACCESS/MODIFY events on child for special files {CVE-2025-68788}
isofs: validate Rock Ridge CE continuation extent against volume size {CVE-2026-46303}
net: strparser: fix skb_head leak in strp_abort_strp() {CVE-2026-46102}
sctp: fix uninit-value in __sctp_rcv_asconf_lookup() {CVE-2026-53225}
xfs: don't swallow dquot recovery verification errors {CVE-2026-80529}
xfs: dquot recovery does not validate the recovered dquot {CVE-2026-80529}
bpf: tcp: fix double sock release on batch realloc {CVE-2026-64575}
bpf: tcp: Fix use-after-free in bpf_iter_tcp_established_batch() {CVE-2026-74714}
bpf: tcp: Avoid socket skips and repeats during iteration {CVE-2026-74714}
bpf: tcp: Use bpf_tcp_iter_batch_item for bpf_tcp_iter_state batch items {CVE-2026-74714}
bpf: tcp: Get rid of st_bucket_done {CVE-2026-74714}
bpf: tcp: Make sure iter->batch always contains a full bucket snapshot {CVE-2026-64575}
bpf: tcp: Make mem flags configurable through bpf_iter_tcp_realloc_batch {CVE-2026-74714}
USB: ldusb: fix use-after-free on disconnect race {CVE-2026-64343}
NFS: Decrement refcounts if allocating nfs_free_stateid_data fails {CVE-2026-74730}
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call {CVE-2026-74730}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
net: Make copy_safe_from_sockptr() match documentation {CVE-2026-74689}
net: add copy_safe_from_sockptr() helper {CVE-2026-74689}
xfs: close crash window in attr dabtree…

Record: CLSA-2026-1789898700
Updated: 2026-11-02

OSVCLSA-2026-1791132991 No score

Fix of 400 CVEs

CVE-2026-53266
- netfilter: bridge: make ebt_snat ARP rewrite writable {CVE-2026-53266}
CVE-2025-39964
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg {CVE-2025-39964}
CVE-2025-39827
- net: rose: include node references in rose_neigh refcount {CVE-2025-39827}
CVE-2026-93140
- udf: Mark LVID buffer as uptodate before marking it dirty {CVE-2026-93140}
CVE-2026-90112
- net: qlcnic: validate unified ROM sections before loading {CVE-2026-90112}
CVE-2026-90237
- netfilter: nft_ct: move custom expectation support to helper {CVE-2026-90237}
CVE-2026-93051
- misc: ad525x_dpot: use driver core groups for sysfs files {CVE-2026-93051}
CVE-2026-90379
- wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash {CVE-2026-90379}
CVE-2026-90302
- ocfs2: synchronize heartbeat callbacks with o2net teardown {CVE-2026-90302}
CVE-2026-90383
- misc: sgi-gru: remove interrupt-context page-table walks {CVE-2026-90383}
CVE-2026-90320
- ocfs2: validate external xattr entries when reading metadata {CVE-2026-90320}
CVE-2026-93047
- drm/v3d: Associate BOs with every job that accesses them {CVE-2026-93047}
CVE-2026-93192
- drm/v3d: Clear queue->active_job when v3d_fence_create() fails {CVE-2026-93192}
CVE-2026-93050
- ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup on remove {CVE-2026-93050}
CVE-2026-90311
- thermal: hwmon: Remove hwmon class device along with its parent {CVE-2026-90311}
CVE-2026-93191
- smack: fix incorrect task context in smack_msg_queue_msgrcv {CVE-2026-93191}
CVE-2026-93042
- dmaengine: dw-edma: Terminate all descriptors without callbacks {CVE-2026-93042}
CVE-2026-93056
- usb: gadget: f_uac1_legacy: remove broken string configfs attributes {CVE-2026-93056}
CVE-2026-93203
- batman-adv: bla: avoid CRC corruption due to parallel claim add {CVE-2026-93203}
CVE-2026-93204
- batman-adv: dat: atomically update mac addresses {CVE-2026-93204}
CVE-2026-90000
- HID: rmi: fix OOB access with undersized RMI reports {CVE-2026-90000}
CVE-2026-90431
- remoteproc: Prevent crash handling to race with rproc_del() {CVE-2026-90431}
CVE-2026-93202
- i3c: master: Fix recursive locking during device registration {CVE-2026-93202}
CVE-2026-90347
- arm64: ptrace: Keep 'orig_x0' in-sync with x0 on syscall entry {CVE-2026-90347}
CVE-2026-90267
- scsi: sd: Fix special_vec mempool leak when scsi_alloc_sgtables() fails {CVE-2026-90267}
CVE-2026-92500
- ext4: use fsdata to track inline data write state and fix race {CVE-2026-92500}
CVE-2026-93196
- nvdimm: virtio_pmem: refcount requests for token lifetime {CVE-2026-93196}
CVE-2026-90207
- ALSA: seq: midi: Serialize input teardown with event_input {CVE-2026-90207}
CVE-2026-90307
- RDMA/srp: fix heap information leak on a truncated SRP_CRED_REQ {CVE-2026-90307}
CVE-2026-90110
- inetpeer: randomize RB-tree node comparison using SipHash {CVE-2026-90110}
CVE-2026-90293
- IB/isert: post the full-feature receive buffers after session registration {CVE-2026-90293}
CVE-2026-89838
- f2fs: limit recovery filename logging to stored length {CVE-2026-89838}
CVE-2026-93177
- drm/amdgpu/pm/powerplay: bounds-check voltage index in Vega10 lookup {CVE-2026-93177}
CVE-2026-89823
- drm: fix race between partial drm_dev_register() failure and ioctl {CVE-2026-89823}
CVE-2026-90041
- HID: sony: clean up device list on probe failure {CVE-2026-90041}
CVE-2026-90015
- xhci: fix lost bounce buffers on TDs spanning several ring segments {CVE-2026-90015}
CVE-2026-93095 -…

Record: CLSA-2026-1791132991
Updated: 2026-11-02

OSVCLSA-2026-1792243729 No score

kernel: Fix of 53 CVEs

ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
Drivers: hv: vmbus: Use after free in __vmbus_open() {CVE-2021-47049}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
netfilter: nf_log: unregister loggers before per-net teardown {CVE-2026-97608}
net: usb: pegasus: don't rely on id table pointer arithmetic {CVE-2026-97540}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
Squashfs: check block offset is not negative {CVE-2026-90203}
tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
net/atm: fix slab-out-of-bounds read in vcc_setsockopt() {CVE-2026-74689}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
drm/amdgpu: reject oversized IBs with per-ring packet limits {CVE-2026-80576}
sctp: validate cookie AUTH state before use {CVE-2026-74752}
ipvlan: inherit needed_headroom and needed_tailroom from phy_dev {CVE-2026-74744}
nvmet: fix pre-auth out-of-bounds heap read in Discovery Get Log Page {CVE-2026-64320}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
isdn: cpai: check ctr->cnr…

Record: CLSA-2026-1792243729
Updated: 2026-11-02

OSVCLSA-2026-1792247642 No score

kernel: Fix of 50 CVEs

ALSA: usx2y: bound the hwdep mmap fault offset {CVE-2026-74641}
ALSA: usx2y: Fix potential leaks of uninitialized memory {CVE-2026-74641}
net/packet: reset the MAC header on the packet-socket transmit path {CVE-2026-74667}
drm/amd/display: Bound VBIOS record-chain walk loops {CVE-2026-53138}
drm/amd/display: Clamp VBIOS HDMI retimer register count to array size {CVE-2026-53136}
tty: clear cdev pointer after cdev_add() failure {CVE-2026-90334}
netfilter: flowtable: publish GC-visible tuple last {CVE-2026-74746}
mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
ethtool: do not perform operations on net devices being unregistered {CVE-2021-47517}
Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
vsock/vmci: fix UAF when peer resets connection during handshake {CVE-2026-64115}
af_unix: Fix UAF read of tail->len in unix_stream_data_wait() {CVE-2026-64109}
tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done {CVE-2026-63801}
tipc: fix double-free in tipc_buf_append() {CVE-2026-52993}
dm: fix a buffer overflow in ioctl processing {CVE-2026-46294}
scsi: qla2xxx: Fix use-after-free of qpair work on queue teardown {CVE-2026-97536}
drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() {CVE-2026-46209}
ipv4: validate checksum_start before completing checksum {CVE-2026-99999}
drm: Remove plane hsub/vsub alignment requirement for core helpers {CVE-2026-46209}
nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
USB: serial: io_edgeport: cap received transmit credits {CVE-2026-68365}
ALSA: seq: close a re-opened queue timer in the destructor {CVE-2026-68202}
geneve: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68142}
net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-63829}
RDMA/mad: Fix receive buffer leak when PKey enforcement fails {CVE-2026-98354}
RDMA/srp: Do not call scsi_done() from srp_abort() {CVE-2023-52515}
wifi: cfg80211: cancel sched scan results work on unregister {CVE-2026-68414}
ppp: defer channel free to an RCU grace period to fix pppol2tp RX UAF {CVE-2026-68398}
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check {CVE-2026-52998}
drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
drm/edid: fix OOB read in drm_parse_tiled_block() {CVE-2026-64546}
ipvs: clear IPv4 options after rebasing tunnel ICMP errors {CVE-2026-74669}
net/sched: cls_api: Always acquire rtnl_lock when destroying locked classifiers {CVE-2026-74700}
bpf, sockmap: Fix sk_redir use-after-free in send verdict {CVE-2026-74589}
bpf: Do mark_chain_precision for ARG_CONST_ALLOC_SIZE_OR_ZERO {CVE-2022-49961}
dm cache: fix null-deref with concurrent writes in passthrough mode {CVE-2026-53064}
net: bonding: fix use-after-free after 802.3ad slave unbind {CVE-2022-49667}
bpf, sockmap: reject overflowing copy + len in bpf_msg_push_data() {CVE-2026-64548}
xen/netfront: drop RX packets with a short Ethernet header {CVE-2026-98375}
NFSv4.2: fix LAYOUTSTATS send buffer exhaustion {CVE-2026-90103}
Squashfs: check block offset is not negative {CVE-2026-90203}
wifi: mt76: mt76x02: do not WARN on invalid rx descriptor length {CVE-2026-90382}
uio: Fix stale info pointer in failed registration path {CVE-2026-93054}
md/raid5-ppl: fix use-after-free in ppl_do_flush() {CVE-2026-93262}
tipc: read le->link under the node lock in tipc_node_link_down() {CVE-2026-74609}
crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
nvme-tcp: fix UAF when detecting digest errors {CVE-2022-48686}
ALSA: 6fire: fix use-after-free on disconnect…

Record: CLSA-2026-1792247642
Updated: 2026-11-02

OSVMGASA-2026-0506 No score

Updated kernel, drakx-installer-images, kmod-nvidia-current-wopengpu, kmod-xtables-addons & kmod-virtualbox packages fix Security Vulnerabilities

Upstream kernel 6.18.55 version fixes bugs and vulnerabilities. The kmod-xtables-addons, kmod-virtualbox, kmod-nvidia-current-wopengpu & drakx-installer-images packages have been updated to work with this new kernel.

Record: MGASA-2026-0506
Updated: 2026-11-02

OSVMGASA-2026-0542 No score

Updated kernel-linus packages fix security vulnerabilities

Vanilla upstream kernel version 6.18.55 fixes vulnerabilities. For information about the vulnerabilities see the links.

Record: MGASA-2026-0542
Updated: 2026-11-02

OSVopenSUSE-SU-2026:22091-1 No score