https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 15:24:46 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74545 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rtase: fix double free of multi-frag skb on DMA map failure</p> <p>In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again.</p> <p>Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>rtase: fix double free of multi-frag skb on DMA map failure</p> <p>In rtase_start_xmit(), when the head buffer DMA mapping fails after rtase_xmit_frags() has mapped all fragments, the error path clears the fragment descriptors with rtase_tx_clear_range(), which frees the skb through the last-frag slot and accounts tx_dropped. Control then falls through to the common error label, which frees the same skb a second time and counts it again.</p> <p>Return right after clearing the fragments when the skb owns frags; the no-frag case still drops through and frees the head skb once.</p> https://vulnerability.circl.lu/vuln/cve-2026-74545