Tagged “csaf”
CVEs tagged csaf, newest first.
7670 CVEsRSS
CVE-2026-98543Medium· 4.1⚖ disputedkernel: bpf: fs/xattr: don't assume the inode is locked in path_unlink/path_rmdir (CVE-2026-98543)
A flaw was found in the Linux kernel. A local privileged user could cause a Denial of Service (DoS) or file system corruption due to improper locking in the BPF (Berkeley Packet Filter) subsystem. When attaching sleepable BPF programs to c…
CVE-2026-98551Low· 3.3kernel: perf/core: Fill branch entries with a single assignment (CVE-2026-98551)
A flaw was found in the Linux kernel's Performance Events (perf) subsystem on ARM64 architectures. This flaw allows a local user to cause an information disclosure of sensitive kernel memory. The issue occurs because certain branch trackin…
CVE-2026-98549Critical· 9.1⚖ disputedtcp: prevent collapsing skbs across boundary in rtx queue
In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue tcp_write_collapse_fence() sets TCP_SKB_CB(skb)->eor = 1 on tcp_write_queue_tail(sk) to prevent skbs queued a…
CVE-2026-98548High· 7.5⚖ disputedkernel: sctp: discard the rest of the packet on a stale-cookie error (CVE-2026-98548)
A flaw was found in the Linux kernel's Stream Control Transmission Protocol (SCTP) implementation. A remote attacker or an unprivileged local user could trigger a Denial of Service (DoS) or memory corruption by sending specially crafted pa…
CVE-2026-98554Medium· 5.5kernel: vlan: ensure sufficient headroom in vlan_dev_hard_header() (CVE-2026-98554)
A flaw was found in the Linux kernel's virtual local area network (VLAN) driver. When processing network packets that lack sufficient reserved buffer space (headroom) before network headers are appended, the system triggers a panic conditi…
CVE-2026-98552Low· 2.5kernel: perf/core: Fix a refcount leak in attach_perf_ctx_data() (CVE-2026-98552)
A flaw was found in the Linux kernel's Performance Counters for Linux (perf) subsystem. A race condition during the attachment of performance monitoring context data can cause the kernel to fail to update tracking flags, resulting in a ref…
CVE-2026-98550High· 7.5kernel: tipc: reject invalid and unexpected GRP_ACK_MSG to prevent bc_ackers underflow (CVE-2026-98550)
A flaw was found in the TIPC (Transparent Inter-Process Communication) subsystem of the Linux kernel. This flaw allows an attacker to cause a Denial of Service (DoS) by sending unexpected or duplicate group acknowledgment messages. Due to …
CVE-2026-98556Medium· 5.5kernel: gve: DQO: reject TSO packets with an out of range MSS (CVE-2026-98556)
A flaw was found in the Linux kernel's Google Virtual NIC (gve) driver. A local user with raw packet access or an adjacent guest system can trigger a Denial of Service (DoS) by sending network packets with an excessively large segment size…
CVE-2026-98555Medium· 4.7⚖ disputedkernel: llc: fix skb UAF and leaks on llc_mac_hdr_init() failure (CVE-2026-98555)
A flaw was found in the Linux kernel's Logical Link Control (LLC) subsystem. When an error occurs during network packet header initialization, the kernel mistakenly frees the incorrect memory buffer, resulting in a use-after-free condition…
CVE-2026-98553Low· 2.3kernel: autofs: fix sbi->pipe file reference leak in autofs_kill_sb() (CVE-2026-98553)
A flaw was found in the Linux kernel's automount file system (autofs). A local user can trigger this issue by initiating an autofs mount operation that fails during initialization, causing the kernel to fail to release associated pipe file…
CVE-2026-98559Medium· 4.7kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err() (CVE-2026-98559)
A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. When processing port errors, the kernel traverses active link groups without holding the appropriate lock, allowing a concurrent termination event to free…
CVE-2026-98557Medium· 5.5kernel: gve: DQO: fix header length used by gve_can_send_tso() for UDP GSO (CVE-2026-98557)
A flaw was found in the Google Virtual Ethernet (gve) driver in the Linux kernel. This vulnerability may allow a local attacker to cause a Denial of Service (DoS) by transmitting network traffic that uses User Datagram Protocol (UDP) Gener…
CVE-2026-98568Medium· 4.7vxlan: use one headroom snapshot for neighbour replies
In the Linux kernel, the following vulnerability has been resolved: vxlan: use one headroom snapshot for neighbour replies vxlan_na_create() samples LL_RESERVED_SPACE() to size the reply skb and then samples it again to reserve headroo…
CVE-2026-98565Medium· 4.4kernel: net: dsa: mt7530: fix NULL dereference on unbind of MT7531 and MT7621 (CVE-2026-98565)
A flaw was found in the Linux kernel's MediaTek MT7530 network switch driver. This flaw allows a local user with administrative privileges to cause a Denial of Service (DoS) through a kernel crash. The issue occurs during driver unbinding …
CVE-2026-98558Medium· 4.1kernel: net: flush skb_defer_nodes in dev_cpu_dead() (CVE-2026-98558)
A flaw was found in the Linux kernel's networking subsystem. When a central processing unit (CPU) is taken offline, pending network packet buffers held in deferred processing queues are not properly flushed. A privileged local user or admi…
CVE-2026-98563Medium· 4.1kernel: net: phylink: record the PHY only once bringup cannot fail (CVE-2026-98563)
A flaw was found in the Linux kernel's phylink component. When an error occurs during Ethernet physical layer (PHY) device initialization, the kernel prematurely stores a reference to the device before setup finishes. If the bringup operat…
CVE-2026-98561Medium· 5.9kernel: nfp: hold IPsec RX state under the XArray lock (CVE-2026-98561)
A flaw was found in the Linux kernel's Netronome Flow Processor (nfp) network driver. A race condition occurs when incoming Internet Protocol Security (IPsec) network packets are processed concurrently with the removal of security associat…
CVE-2026-98560Low· 3.3kernel: net/rds: size a connection's path set by the transport it ends up with (CVE-2026-98560)
A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When handling local connections, the system miscalculates the required communication paths, allocating internal work queues that are not properly freed durin…
CVE-2026-98567Medium· 5.5kernel: net: xps: reject an out of range traffic class (CVE-2026-98567)
A flaw was found in the Linux kernel. A local privileged user could trigger a Denial of Service (DoS) or kernel memory corruption by causing an out-of-bounds memory write. This issue occurs in the Transmit Packet Steering (XPS) networking …
CVE-2026-98564Medium· 4.1kernel: net: dsa: mt7530: leave the MDIO IRQ mappings to regmap-irq (CVE-2026-98564)
A flaw was found in the Linux kernel's MediaTek MT7530 DSA (Distributed Switch Architecture) driver. During device removal or driver unbinding, interrupt mappings are prematurely disposed while the parent interrupt is still active. A local…
CVE-2026-98562Medium· 4.7kernel: net: libwx: fix races in Tx timestamp handling (CVE-2026-98562)
A flaw was found in the Linux kernel's Wangxun network driver library (libwx). This vulnerability allows a local user to cause a Denial of Service (DoS) through memory corruption. A race condition in the Precision Time Protocol (PTP) trans…
CVE-2026-98570Medium· 5.9kernel: net: ipv6: keep room for the mac header in dst_dev_overhead() (CVE-2026-98570)
A flaw was found in the Linux kernel's IPv6 networking subsystem. An unauthenticated remote attacker can cause a Denial of Service (DoS) by sending network traffic through an affected IPv6 tunnel interface. Due to insufficient buffer alloc…
CVE-2026-98569Medium· 4.4kernel: ip_gre: Reject enabling collect metadata through changelink (CVE-2026-98569)
A flaw was found in the Linux kernel's Generic Routing Encapsulation (GRE) subsystem. A local user with network administration privileges could cause a Denial of Service (DoS) by enabling metadata collection on an existing GRE network devi…
CVE-2026-98566Medium· 5.5kernel: drm/imagination: clamp freelist reconstruction requests (CVE-2026-98566)
A flaw was found in the Linux kernel's drm/imagination GPU driver. The driver fails to properly validate and bound the firmware reconstruction count against the fixed protocol array capacity when processing freelist reconstruction requests…
CVE-2026-98573High· 7.5kernel: net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6() (CVE-2026-98573)
A flaw was found in the Linux kernel. An integer underflow in the networking subsystem allows an attacker to trigger an out-of-bounds memory copy by sending specially crafted Internet Protocol version 6 (IPv6) packets with extension header…
CVE-2026-98572Medium· 4.4kernel: bpf: Fix immediate JMP JEQ/JNE on MIPS32 (CVE-2026-98572)
A flaw was found in the Linux kernel's extended Berkeley Packet Filter (eBPF) Just-In-Time (JIT) compiler on 32-bit MIPS systems. An instruction generation error during 64-bit jump comparisons causes negative numeric constants to be incorr…
CVE-2026-98571Medium· 5.9kernel: net: stmmac: clear stale buf->page after recycling on skb build failure (CVE-2026-98571)
A flaw was found in the Linux kernel's stmmac network driver. This vulnerability can lead to a Denial of Service (DoS) or memory corruption when processing incoming network traffic under resource constraints. When the driver fails to alloc…
CVE-2026-98577Medium· 5.3kernel: nfc: llcp: fix WKS SAP hijacking via prefix match in nfc_llcp_wks_sap() (CVE-2026-98577)
A flaw was found in the Linux kernel's Near Field Communication (NFC) subsystem. In the Logical Link Control Protocol (LLCP) implementation, the kernel validates service names using only the length of the provided name instead of verifying…
CVE-2026-98574Medium· 4.1kernel: net: bcmgenet: stop Tx NAPI before disabling the queues (CVE-2026-98574)
A flaw was found in the Linux kernel's Broadcom GENET network driver. Improper synchronization between disabling transmission queues and stopping completion polling during interface shutdown or suspend operations can prematurely re-enable …
CVE-2026-98579Low· 3.3kernel: nfc: llcp: fix sdreq TLV list leak on parse/alloc/send failure (CVE-2026-98579)
A flaw was found in the Linux kernel's NFC (Near Field Communication) subsystem. Error handling routines in the netlink interface fail to properly release allocated memory when processing service discovery requests encounters a failure. A …