CVE-2026-68119

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

EUVD-2026-55500

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

CVE-2026-68119

The CVE-2026-68119 issue concerns the Linux kernel TCP-AO implementation: when constructing standalone TCP responses with TCP-AO options, the TCP header padding is not fully initialized if the MAC length is not four-byte aligned. The function tcp_ao_hash_hdr() writes only the MAC, leaving 1–3 pad...

CVE-2026-64459

A flaw was found in the Linux kernel's TCP-AO TCP Authentication Option implementation. An unprivileged local user can exploit a use-after-free vulnerability in the tcpaodestroysock function. By manipulating TCP sockets with TCPMD5SIG and TCPAOADDKEY, an attacker can trigger a race condition duri...

CVE-2026-53389

A flaw was found in the Linux kernel's TCP Authentication Option TCP-AO implementation. When a TCP-AO key is deleted asynchronously, the system fails to clear pointers to the freed memory. This can allow an attacker to access previously freed memory, potentially leading to information disclosure ...

CVE-2026-53389

In the Linux kernel, the following vulnerability has been resolved: net/tcp-ao: fix use-after-free of key in delasync path In tcpaodeletekey, the delasync path skips the currentkey and rnextkey validity checks present in the synchronous path, assuming these pointers are always NULL on LISTEN...

CVE-2026-43384

A flaw was found in the Linux kernel's TCP Authentication Option TCP-AO implementation. This vulnerability arises from a non-constant-time comparison of Message Authentication Codes MACs. A remote attacker could potentially exploit this timing discrepancy to perform a timing attack, which may lea...

JLSEC-2026-436

libcurl can in some circumstances reuse the wrong connection when asked to do an Negotiate-authenticated HTTP or HTTPS request. libcurl features a pool of recent connections so that subsequent requests can reuse an existing connection to avoid overhead. When reusing a connection a range of...

MiracleLinux 9 : iperf3-3.9-13.el9 (AXSA:2024-9259:02)

The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2024-9259:02 advisory. iperf3: possible denial of service CVE-2023-7250,ESNET-SECADV-2023-0002 iperf3: vulnerable to marvin attack if the authentication option is used...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/tcp: A NULL pointer dereference occurred when using TCP-AO with TCPREPAIR. A NULL pointer dereference can occur in the tcpaofinishconnect function during a connect system call on a socket where TCP-AO is enabled and TCPREPAIR...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fixed a socket memory leak in the handling of TCP-AO failures for IPv6. When tcpaocopyallmatching fails in tcpv6synrecvsock, the function simply exits. This results in a memory leak: unreferenced object 0xffff0000281a820...

CVE-2025-39950

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system call on a socket with a TCP-AO key added and TCPREPAIR enabled. The...

Linux Distros Unpatched Vulnerability : CVE-2025-39950

"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system cal...

EUVD-2025-32388

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system call on a socket with a TCP-AO key added and TCPREPAIR enabled. The...

CVE-2025-39950

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system call on a socket with a TCP-AO key added and TCPREPAIR enabled. The...

UBUNTU-CVE-2025-39950

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system call on a socket with a TCP-AO key added and TCPREPAIR enabled. The...

CVE-2025-39950

CVE-2025-39950 pertains to the Linux kernel: a NULL pointer dereference can occur in net/tcp when TCP-AO is used with TCP_REPAIR during connect(), due to dereferencing skb without null-check in tcp_ao_finish_connect(). The vulnerability affects code paths where a TCP-AO key is present and TCP_REP...

CVE-2025-39950 net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCPREPAIR A NULL pointer dereference can occur in tcpaofinishconnect during a connect system call on a socket with a TCP-AO key added and TCPREPAIR enabled. The...

CVE-2025-39852

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcpaocopyallmatching fails in tcpv6synrecvsock it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 size...

DEBIAN-CVE-2025-39852

In the Linux kernel, the following vulnerability has been resolved: net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 When tcpaocopyallmatching fails in tcpv6synrecvsock it just exits the function. This ends up causing a memory-leak: unreferenced object 0xffff0000281a8200 size...