https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 01:48:00 +0000 https://db.gcve.eu/vuln/cve-2026-53227 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: openvswitch: fix possible kfree_skb of ERR_PTR</p> <p>After the patch in the &#34;Fixes&#34; tag, the allocation of the &#34;reply&#34; skb can happen either before or after locking the ovs_mutex.</p> <p>However, error cleanups still follow the classical reversed order, assuming &#34;reply&#34; is allocated before locking: it is freed after unlocking.</p> <p>If &#34;reply&#34; allocation happens after locking the mutex and it fails, &#34;reply&#34; is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer.</p> <p>Fix this by setting the pointer to NULL after having saved its error value.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net: openvswitch: fix possible kfree_skb of ERR_PTR</p> <p>After the patch in the &#34;Fixes&#34; tag, the allocation of the &#34;reply&#34; skb can happen either before or after locking the ovs_mutex.</p> <p>However, error cleanups still follow the classical reversed order, assuming &#34;reply&#34; is allocated before locking: it is freed after unlocking.</p> <p>If &#34;reply&#34; allocation happens after locking the mutex and it fails, &#34;reply&#34; is left with an ERR_PTR, and execution jumps to the correspondent cleanup stage which will try to free an invalid pointer.</p> <p>Fix this by setting the pointer to NULL after having saved its error value.</p> https://db.gcve.eu/vuln/cve-2026-53227