Kernel CVEs and hardening patches

The Linux kernel published several CVE fixes spanning IPv4 routing, virtual Ethernet, TLS receive paths, packet sockets, BPF, and USB audio, plus related hardening patches. The issues center on allocation failures, out-of-bounds access, reference counting errors, and verifier gaps that can panic systems or leak data.

ipv4 fib_nlmsg_size undercounts RTA_VIA nexthops

The kernel announced CVE-2026-74657 for fib_nlmsg_size() failing to account for RTA_VIA nexthops when sizing netlink messages. The undercount can produce skb allocation failure and a potential panic. Operators of routing-heavy or netlink-intensive systems should track the stable fix.

veth XDP frag length accounting leak

CVE-2026-74612 covers a veth bug in skb length accounting after XDP fragment adjustment. The error leaked kernel pointers and data to userspace. The fix lands in the stable trees for environments that combine veth with XDP.

TLS 1.3 rx iterator overwrite

CVE-2026-74611 restores the msg_iter before a TLS 1.3 optimistic retry on the receive path. Without the restore, TLS_RX_EXPECT_NO_PAD handling can overwrite buffers. Hosts terminating TLS in the kernel need the correction.

BPF verifier rejects stack-argument callbacks

A v2 patch series rejects BPF callback subprograms that pass stack arguments beyond the five-argument limit. The verifier previously allowed such programs, leading to out-of-bounds reads on x86-64 and KASAN slab-write reports. BPF authors and runtime maintainers should expect stricter verification.

packet socket MAC header reset on transmit

CVE-2026-74667 resets the MAC header on the packet-socket transmit path when PACKET_QDISC_BYPASS is used. Missing the reset permitted out-of-bounds MAC header access. Packet-socket users relying on qdisc bypass are affected.

fork initializes function graph state earlier

A v2 patch initializes function graph state before copy_exec_state() during fork. On non-CLONE_VM error paths the parent ftrace ret_stack could be used after free, as shown by KASAN, and the change is marked for stable. Systems with function graph tracing enabled gain protection on failed forks.

BPF conntrack kfuncs netns refcount imbalance

CVE-2026-74715 fixes a netns reference imbalance in BPF conntrack kfuncs. The imbalance can trigger panics or premature namespace destruction. BPF programs that touch conntrack across namespaces require the update.

ALSA usb-audio Type II inbound URB OOB write

CVE-2026-74682 addresses an out-of-bounds write in ALSA usb-audio handling of Type II inbound URBs. The stable tree carries the fix for USB audio devices that exercise that path.