Most recent entries from all

BELL-CVE-2026-53259

2026-10-02T22:07:03.891729+00:00

Affected: Alpaquita:stream: linux-lts

certfr-2026-avi-1162 — De multiples vulnérabilités ont été découvertes dans le noyau Linux d'Ubuntu. Certaines d'entre elles permettent à un a…

2026-10-02T22:07:03.891781+00:00

certfr-2026-avi-1162

EUVD-2026-348219

2026-10-02T22:07:03.891802+00:00

EUVD-2026-348219

fkie_cve-2026-53259

2026-10-02T22:07:03.891814+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: anycast: insert aca into global hash under idev->lock

syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node.

In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev->ac_list under idev->lock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL) can slip into that window:

CPU0 __ipv6_dev_ac_inc CPU1 ipv6_ac_destroy_dev (RTNL) ------------------------------ ------------------------------------ aca_alloc() refcnt 1 aca_get() refcnt 2 write_lock_bh(idev->lock) add aca to ac_list write_unlock_bh(idev->lock) write_lock_bh(idev->lock) pull aca off ac_list write_unlock_bh(idev->lock) ipv6_del_acaddr_hash(aca) hlist_del_init_rcu() is a no-op, aca is not in the hash yet aca_put() refcnt 2->1 ipv…

GHSA-hqjh-c323-5jv8

2026-10-02T22:07:03.891862+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv6: anycast: insert aca into global hash under idev->lock

RHSA-2026:64775 — Red Hat Security Advisory: kernel security, bug fix, and enhancement update

2026-10-02T22:07:03.891897+00:00

kernel: can: bcm: add locking for bcm_op runtime updates kernel: ipv6: add NULL checks for idev in SRv6 paths kernel: udp: Fix wildcard bind conflict check when using hash2 kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() kernel: tcp: call sk_data_ready() after listener migration kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP kernel: flow_dissector: do not dissect PPPoE PFC frames kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls kernel: net: guard timestamp cmsgs to real error queue skbs kernel: ipv6: sit: reload inner IPv6 header after GSO offloads kernel: net: add pskb_may_pull() to skb_gro_receive_list() kernel: ipv6: anycast: insert aca into global hash under idev->lock kernel: ipv6: mcast: Fix use-after-free when processing MLD queries kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation kernel: vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() kernel: fuse: clear intr_entry in fuse_resend and fuse_remove_pending_req kernel: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU kernel: nvmet-auth: validate reply message payload bounds against transfer length kernel: rhashtable: clear stale iter->p on table restart kernel: smb: client: fix double-free in SMB2_close() replay

RLSA-2026:64775 — Important: kernel security, bug fix, and enhancement update

2026-10-02T22:07:03.891955+00:00

Affected: Rocky Linux:10: kernel

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

* kernel: can: bcm: add locking for bcm_op runtime updates (CVE-2025-38004)

* kernel: ipv6: add NULL checks for idev in SRv6 paths (CVE-2026-23442)

* kernel: udp: Fix wildcard bind conflict check when using hash2 (CVE-2026-31503)

* kernel: ipv6: prevent possible UaF in addrconf_permanent_addr() (CVE-2026-43339)

* kernel: tcp: call sk_data_ready() after listener migration (CVE-2026-46015)

* kernel: inet: RAW sockets using IPPROTO_RAW MUST drop incoming ICMP (CVE-2026-46266)

* kernel: flow_dissector: do not dissect PPPoE PFC frames (CVE-2026-46306)

* kernel: io_uring/poll: fix signed comparison in io_poll_get_ownership() (CVE-2026-52933)

* kernel: ppp: require CAP_NET_ADMIN in target netns for unattached ioctls (CVE-2026-53075)

* kernel: KVM: arm64: Take the SRCU lock for page table walks in fault injection and AT emulation (CVE-2026-53277)

* kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228)

* kernel: net: add pskb_may_pull() to skb_gro_receive_list() (CVE-2026-53235)

* kernel: net: guard timestamp cmsgs to real error queue skbs (CVE-2026-53223)

* kernel: ipv6: mcast: Fix use-after-free when processing MLD queries (CVE-2026-53275)

* kernel: ipv6: anycast: insert aca into global hash under idev->lock (CVE-2026-53259)

* kernel: ipv4: free net->ipv4.sysctl_local_reserved_ports after unregister_net_sysctl_table() (CVE-2026-64002)

*…

UBUNTU-CVE-2026-53259

2026-10-02T22:07:03.892002+00:00

Affected: Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3, Ubuntu:18.04:LTS: linux-gke-4.15, Ubuntu:18.04:LTS: linux-gke-5.4 and 128 more

In the Linux kernel, the following vulnerability has been resolved: ipv6: anycast: insert aca into global hash under idev->lock syzbot reported a splat [1]: a slab-use-after-free in ipv6_chk_acast_addr(), which walks the global inet6_acaddr_lst[] hash under RCU and dereferences a struct ifacaddr6 that has already been freed while still linked in the hash, so a later reader walks into a dangling node. In __ipv6_dev_ac_inc() the aca is allocated with refcount 1, then aca_get() bumps it to 2 to keep it alive across the unlocked region. It is published to idev->ac_list under idev->lock, but ipv6_add_acaddr_hash() runs after write_unlock_bh(). A concurrent teardown (ipv6_ac_destroy_dev() from addrconf_ifdown(), under RTNL) can slip into that window: CPU0 __ipv6_dev_ac_inc CPU1 ipv6_ac_destroy_dev (RTNL) ------------------------------ ------------------------------------ aca_alloc() refcnt 1 aca_get() refcnt 2 write_lock_bh(idev->lock) add aca to ac_list write_unlock_bh(idev->lock) write_lock_bh(idev->lock) pull aca off ac_list write_unlock_bh(idev->lock) ipv6_del_acaddr_hash(aca) hlist_del_init_rcu() is a no-op, aca is not in the hash yet aca_put() refcnt 2->1 ipv6_ad…

WID-SEC-W-2026-2077 — Linux Kernel: Mehrere Schwachstellen

2026-10-02T22:07:03.892179+00:00

Ein entfernter Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Sicherheitsvorkehrungen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen und weitere, nicht näher spezifizierte Auswirkungen zu erzielen.