https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 16:30:27 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-68198 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-68198 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1090 certfr-2026-avi-1090 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1090 https://cve.radiocsirt.org/vuln/euvd-2026-357847 EUVD-2026-357847 https://cve.radiocsirt.org/vuln/euvd-2026-357847 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68198 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: ath6kl: fix use-after-free in aggr_reset_state()</p> <p>The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().</p> <p>If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().</p> <p>Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.</p> <p>Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: ath6kl: fix use-after-free in aggr_reset_state()</p> <p>The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().</p> <p>If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().</p> <p>Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.</p> <p>Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68198 https://cve.radiocsirt.org/vuln/ghsa-mrq7-mrhj-vm2g <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: ath6kl: fix use-after-free in aggr_reset_state()</p> <p>The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().</p> <p>If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().</p> <p>Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.</p> <p>Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>wifi: ath6kl: fix use-after-free in aggr_reset_state()</p> <p>The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy().</p> <p>If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy().</p> <p>Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition.</p> <p>Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> https://cve.radiocsirt.org/vuln/ghsa-mrq7-mrhj-vm2g https://cve.radiocsirt.org/vuln/msrc_cve-2026-68198 msrc_CVE-2026-68198 https://cve.radiocsirt.org/vuln/msrc_cve-2026-68198 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23881-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23881-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68198 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: wifi: ath6kl: fix use-after-free in aggr_reset_state() The aggr_reset_state() function uses timer_delete() (non-synchronous) for the aggregation timer before proceeding to delete TID state and before the structure is freed by callers like aggr_module_destroy(). If the timer callback (aggr_timeout) is executing when aggr_reset_state() is called, the callback will continue to access aggr_conn fields like rx_tid[] and stat[] which may be freed immediately after by kfree(aggr_info-&gt;aggr_conn) in aggr_module_destroy(). Additionally, the timer callback can re-arm itself via mod_timer() while aggr_reset_state() is running, creating a more complex race condition. Use timer_delete_sync() instead to ensure any running timer callback has completed before returning.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68198 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730