SUSE SLES15 Security Update : kernel (Live Patch 18 for SUSE Linux Enterprise 15 SP7) (SUSE-SU-2026:4359-1)

The remote SUSE Linux SLES15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4359-1 advisory. This update for the SUSE Linux Enterprise Kernel 6.4.0-150700.53.66 fixes various security issues: The following security issues were fixed: -...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers CVE-2026-68082 In the Linux kernel, the following vulnerability has been resolved: libceph: bound pgtemp,upmap,upmapitems length to CEPHPGMAXSIZE CVE-2026-6815...

Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-3139)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-3139 advisory. In the Linux kernel, the following vulnerability has been resolved: libceph: fix two unsafe bare decodes in decodelockers CVE-2026-68082 In the Linux kernel, the following vulnerability has be...

SUSE CVE-2026-97959

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsroute: free emptied bucket on filter move route4change can move an existing filter to a different top-level bucket: route4setparms recomputes the handle from TCAROUTE4TO/ FROM/IIF, and the handle-mismatch check is...

SUSE CVE-2026-97973

In the Linux kernel, the following vulnerability has been resolved: net: macb: destroy the phylink instance on the probe error path macbmiiinit creates a phylink instance on both of its success paths, but the probe unwind frees the netdev without destroying it, so a failing macballoctieoff or...

SUSE CVE-2026-97981

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Count dropped frames as NAPI work The RX loop only consumes budget when it successfully delivers a frame. Error paths keep consuming descriptors without reducing the budget, so a stream of bad frames can...

SUSE CVE-2026-98008

In the Linux kernel, the following vulnerability has been resolved: net: macb: fix NULL pointer dereference on unbind with fixed-link When the device tree describes a fixed-link and has no "mdio" child node, macbmiiinit returns early without allocating the MDIO bus, leaving bp-miibus as NULL. Two...

SUSE CVE-2026-98017

In the Linux kernel, the following vulnerability has been resolved: net/sched: defer qdisc freeing after failed creation An RTMNEWQDISC request can make clsact bind a populated shared ingress block during -init, publishing an embedded miniQdisc to lockless readers. If the same request has an...

CVE-2026-18746 NULL pointer dereference in Zephyr LwM2M client when the CoAP Block1 context pool is exhausted

parsewriteop in subsys/net/lib/lwm2m/lwm2mmessagehandling.c handles inbound CoAP WRITE/CREATE requests that carry a Block1 option. For the first block of a transfer it called initblockctx and then immediately stored the peer-selected block size with blockctx-ctx.blocksize = blocksize before...

CVE-2026-18417 Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket reports an asynchronous error

The native BSD-socket layer recorded a pending asynchronous socket error by type-punning it into struct netcontext's void userdata field ctx-userdata = INTTOPOINTER-status in zsockacceptedcb, zsockreceivedcb, zsockconnectedcb and zsockclosectx in subsys/net/lib/sockets/socketsinet.c, reading it...

CVE-2026-18416

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

CVE-2026-18416 Out-of-bounds read in CoAP well-known-core Uri-Query href matching (match_path_uri)

The CoAP link-format helper matchpathuri in subsys/net/lib/coap/coaplinkformat.c compares a registered resource path against the URI carried in a Uri-Query href= option. That URI is not NUL terminated, but the inner character loop advanced its index k once per path character without ever testing ...

EUVD-2026-88473

ieee802154send in subsys/net/l2/ieee802154/ieee802154.c copies the outgoing packet into a single fixed 125-byte transmit buffer txframebufpool, sized IEEE802154MTU. In builds with CONFIGNETL2IEEE802154FRAGMENT enabled the default whenever CONFIGNET6LO is set, the branch taken when 6LoWPAN...

net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service

A flaw was found in the net/http component of the Go standard library. When a server is configured to support unencrypted HTTP/2, it reads initial bytes from new connections to detect the HTTP/2 client preface. However, the ReadHeaderTimeout is not correctly applied during this process. This...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect

A flaw was found in the net/http package of the Golang standard library. The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header redirected to b.com/ will not send that header to b.com. However, the...

Important: Red Hat Security Advisory: git-lfs security update

An update for git-lfs is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...

net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution

A flaw was found in net/url, a component of golang. This vulnerability arises when resolving relative paths that contain numerous parent directory '..' segments. A remote attacker could exploit this by providing a specially crafted path, leading to quadratic time complexity and excessive memory...

golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing

A flaw was found in golang.org/x/net/idna. ToASCII and ToUnicode incorrectly accept Punycode-encoded labels that decode to an ASCII-only hostname for example, xn--example-.com returns example.com instead of an error. Applications that validate the ASCII form then convert to Unicode may grant acce...

net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME

A flaw was found in the net package of Go golang, specifically when using the LookupCNAME function with the cgo DNS resolver. A remote attacker could exploit this by providing a very long Canonical Name CNAME response. This can trigger a double-free of C memory, leading to a crash and a Denial of...