https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 23:48:29 +0000 https://cve.radiocsirt.org/vuln/bell-cve-2026-72035 <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> <p><strong>Affected:</strong> Alpaquita:23: linux-lts, Alpaquita:25: linux-lts, Alpaquita:stream: linux-lts</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-72035 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1163 certfr-2026-avi-1163 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1163 https://cve.radiocsirt.org/vuln/euvd-2026-357867 EUVD-2026-357867 https://cve.radiocsirt.org/vuln/euvd-2026-357867 https://cve.radiocsirt.org/vuln/fkie_cve-2026-72035 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked</p> <p>When taprio&#39;s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child -&gt;dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child&#39;s qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.</p> <p>Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child&#39;s stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked</p> <p>When taprio&#39;s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child -&gt;dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child&#39;s qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.</p> <p>Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child&#39;s stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-72035 https://cve.radiocsirt.org/vuln/ghsa-cjrv-4qm5-hp28 <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked</p> <p>When taprio&#39;s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child -&gt;dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child&#39;s qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.</p> <p>Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child&#39;s stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked</p> <p>When taprio&#39;s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child -&gt;dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child&#39;s qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress.</p> <p>Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child&#39;s stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.</p> https://cve.radiocsirt.org/vuln/ghsa-cjrv-4qm5-hp28 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21910-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 <p>Security update for the Linux Kernel</p> <p>Security update for the Linux Kernel</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23477-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-72035 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 219 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked When taprio&#39;s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child -&gt;dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child&#39;s qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child&#39;s stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: linux-hwe-edge, Ubuntu:18.04:LTS: linux-aws-5.0, Ubuntu:18.04:LTS: linux-aws-5.3, Ubuntu:Pro:18.04:LTS: linux-aws-5.4, Ubuntu:18.04:LTS: linux-azure, Ubuntu:18.04:LTS: linux-azure-5.3, Ubuntu:Pro:18.04:LTS: linux-azure-5.4, Ubuntu:18.04:LTS: linux-azure-edge, Ubuntu:18.04:LTS: linux-gcp, Ubuntu:18.04:LTS: linux-gcp-5.3 and 219 more</p> <p>In the Linux kernel, the following vulnerability has been resolved: net/sched: sch_taprio: Replace direct dequeue call with peek and qdisc_dequeue_peeked When taprio&#39;s software path peeks a non-work-conserving child qdisc, the child stashes the peeked skb in its gso_skb; taprio_dequeue_from_txq() then takes the packet with a direct child -&gt;dequeue() call, which ignores that stash, orphans the peeked skb and desyncs the child&#39;s qlen/backlog. With a qfq child this re-enters the child on an emptied list and dereferences NULL, panicking the kernel from softirq on ordinary egress. Take the packet through qdisc_dequeue_peeked(), as sch_red and sch_sfb now do. The helper returns the child&#39;s stashed skb first and is a no-op when there is none, so a work-conserving child is unaffected and the gated path now consumes the skb whose length was charged to the budget.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-72035 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2852 <p>Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in Linux Kernel ausnutzen, um root Rechte zu erlangen, um einen Denial of Service herbeizuführen oder einen nicht näher spezifizierten Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2852