Most recent entries from all

CVE-2026-23204 — net/sched: cls_u32: use skb_header_pointer_careful()

Affected: Linux, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0 net/sched/cls_u32.c:221

RHSA-2026:10108 — Red Hat Security Advisory: kernel security update

kernel: Bluetooth: MGMT: Fix possible UAFs kernel: mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats kernel: Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg kernel: Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check kernel: Linux kernel: Local denial of service and memory leak in DAMON sysfs via setup failure kernel: Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution kernel: scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() kernel: net/sched: cls_u32: use skb_header_pointer_careful() kernel: kernel: Privilege escalation or denial of service via use-after-free in nf_tables_addchain() kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache

RHSA-2026:19568 — Red Hat Security Advisory: kernel security update

kernel: net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit kernel: scsi: qla2xxx: Fix improper freeing of purex item kernel: libceph: make decode_pool() more resilient against corrupted osdmaps kernel: libceph: prevent potential out-of-bounds reads in handle_auth_done() kernel: libceph: replace overzealous BUG_ON in osdmap_apply_incremental() kernel: Linux kernel: Denial of Service in libceph OSD client due to unreset sparse-read state kernel: net/sched: cls_u32: use skb_header_pointer_careful() kernel: Linux kernel: Use-after-free in traffic control (act_ct) may lead to denial of service or privilege escalation kernel: Linux kernel KVM: Privilege escalation or denial of service due to improper shadow page table entry handling kernel: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache kernel: can: raw: fix ro->uniq use-after-free in raw_rcv() kernel: usbip: validate number_of_packets in usbip_pack_ret_submit() kernel: RDMA/umem: Fix double dma_buf_unpin in failure path kernel: md/bitmap: fix GPF in write_page caused by resize race kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel kernel: net: skbuff: propagate shared-frag marker through frag-transfer helpers kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel kernel: Read root-owned files as an unprivileged user