https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:09:35 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-68397 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-68397 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1069 certfr-2026-avi-1069 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1069 https://cve.radiocsirt.org/vuln/euvd-2026-356324 EUVD-2026-356324 https://cve.radiocsirt.org/vuln/euvd-2026-356324 https://cve.radiocsirt.org/vuln/fkie_cve-2026-68397 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: take a reference on the socket found in afiucv_hs_rcv()</p> <p>afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -&gt; sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk-&gt;sk_data_ready() in afiucv_hs_callback_syn()).</p> <p>Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: take a reference on the socket found in afiucv_hs_rcv()</p> <p>afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -&gt; sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk-&gt;sk_data_ready() in afiucv_hs_callback_syn()).</p> <p>Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-68397 https://cve.radiocsirt.org/vuln/ghsa-7m4h-5x7q-hf25 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: take a reference on the socket found in afiucv_hs_rcv()</p> <p>afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -&gt; sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk-&gt;sk_data_ready() in afiucv_hs_callback_syn()).</p> <p>Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/iucv: take a reference on the socket found in afiucv_hs_rcv()</p> <p>afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -&gt; sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk-&gt;sk_data_ready() in afiucv_hs_callback_syn()).</p> <p>Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.</p> https://cve.radiocsirt.org/vuln/ghsa-7m4h-5x7q-hf25 https://cve.radiocsirt.org/vuln/msrc_cve-2026-68397 msrc_CVE-2026-68397 https://cve.radiocsirt.org/vuln/msrc_cve-2026-68397 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68397 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -&gt; sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk-&gt;sk_data_ready() in afiucv_hs_callback_syn()). Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: linux, Ubuntu:Pro:14.04:LTS: linux-aws, Ubuntu:Pro:14.04:LTS: linux-azure, Ubuntu:Pro:14.04:LTS: linux-lts-xenial, Ubuntu:Pro:16.04:LTS: linux, Ubuntu:Pro:16.04:LTS: linux-aws, Ubuntu:Pro:16.04:LTS: linux-aws-hwe, Ubuntu:Pro:16.04:LTS: linux-azure, Ubuntu:Pro:16.04:LTS: linux-gcp, Ubuntu:Pro:16.04:LTS: linux-hwe and 246 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/iucv: take a reference on the socket found in afiucv_hs_rcv() afiucv_hs_rcv() looks up the destination socket under iucv_sk_list.lock, drops the lock, and then passes the socket to the afiucv_hs_callback_*() handlers without holding a reference. AF_IUCV sockets are not RCU-protected and are freed synchronously by iucv_sock_kill() -&gt; sock_put(), so a concurrent close can free the socket in the window between read_unlock() and the handler, which then dereferences freed memory (for example sk-&gt;sk_data_ready() in afiucv_hs_callback_syn()). Take a reference with sock_hold() while the socket is still on the list and release it with sock_put() once the handler has run.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-68397 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730 <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> <p>Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, darunter möglicherweise die Ausführung von beliebigem Code, die Ausweitung von Berechtigungen, die Offenlegung von Informationen, die Manipulation von Daten oder Denial-of-Service-Zustände.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2730