A memory overflow vulnerability exists within the Linux kernel's networking subsystem. Specifically, an application can set the SO_RCVBUF socket option to its maximum value (INT_MAX), which triggers an integer overflow within the udp_rmem_release() function during socket closure. The udp_destruct_common() purges its receive queue and sums up skb->truesize in the queue. This total is calculated and stored in a local unsigned integer variable. The total size is then passed to udp_rmem_release() to adjust memory accounting. Due to the function taking a signed integer argument, the total size can wrap around, causing a memory overflow condition, potentially leading to system instability.

In the Linux kernel, the following vulnerability has been resolved: net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too.

In the Linux kernel, the following vulnerability has been resolved: RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction.

In the Linux kernel, the following vulnerability has been resolved: vsock: Transport assignment may race with module unload.

In the Linux kernel, the following vulnerability has been resolved: tipc: Fix use-after-free in tipc_conn_close().

The vulnerability in nf_conntrack can be triggered by an unprivileged user under typical configurations where user and network namespaces are available (e.g., via unshare or CLONE_NEWNET). This enables the user to initiate Netfilter-based networking operations (such as NAT or connection tracking) even if the system had no prior active conntrack entries. Since exploitation does not require elevated privileges beyond what is granted in the default namespace setup with CAP_NET_RAW or similar, the Privileges Required (PR) is assessed as Low. The primary attack vector is remote-triggered packets from user-controlled namespaces that cause conntrack allocation and destruction races, leading to a potential kernel panic.

In the Linux kernel, the following vulnerability has been resolved: ext4: only dirty folios when data journaling regular files.