[kernel-cve-report] New CVE entries this week

Masami Ichikawa <[email protected]> Thu, 16 Jul 2026 07:07:01 +0900

Newsgroups	org.cip-project.lists.cip-dev
Message-ID	<CAODzB9p684-qvu9bvwoaGHX4FfEEpsL05ELp6+4ZXvdi73P7Fw@mail.gmail.com>

Hi!

It's this week's CVE report.

This week reported 3 new CVEs and 0 updated CVEs.

* New CVEs
CVE-2026-53363: xfrm: iptfs: preserve shared-frag marker in
iptfs_consume_frags()

Announce: https://www.cve.org/CVERecord?id=CVE-2026-53363

Introduced by commit b96ba31 ("xfrm: iptfs: share page fragments of
inner packets") in v6.14-rc1.
Fixed in v7.1.

Bug introduced commit is not backported to older stable kernels.

Fixed status
mainline: [e9096a5a170e7ecd6467bc2e08668ec39897cda7]
stable/6.18: [dd66f7f6e360ee82cd905517726f8e9091265de5]

CVE-2026-53364: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate()

Announce: https://www.cve.org/CVERecord?id=CVE-2026-53364

Introduced by commit a7bcffc ("Bluetooth: Add PA_LINK to distinguish
BIG sync and PA sync connections") in v6.17-rc1.
Fixed in v7.1-rc6.

Bug introduced commit is not backported to older stable kernels.

Fixed status
mainline: [bfa9d28960ed677d556bdf097073bc3129686229]
stable/6.18: [e6b78019664dfe37c3dc707f50e7b453d6c7726d]

CVE-2026-53365: vsock/virtio: fix zerocopy completion for multi-skb sends

Announce: https://www.cve.org/CVERecord?id=CVE-2026-53365

Introduced by commit 581512a ("vsock/virtio: MSG_ZEROCOPY flag
support") in v6.7-rc1.
Fixed in v7.1-rc5.

Bug introduced commit is not backported to older stable kernels.

Fixed status
mainline: [ae38d9179190a956e2a87a69ef1dd6f451b51c4d]
stable/6.18: [76b995bc57bd90cb6e954e1966fbd8786da47f0d]

* Updated CVEs

No updated CVEs.

Regards,
-- 
Masami Ichikawa
Cybertrust Japan Co., Ltd.

Email :[email protected]
          :[email protected]