EUVD-2026-59494

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used...

CVE-2026-72423 bpf: Guard conntrack opts error writes

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72423

The CVE-2026-72423 vulnerability affects the Linux kernel’s BPF conntrack error reporting: wrappers for conntrack kfuncs may write to opts->error outside the verifier-checked range, for certain sizes. The issue occurs when using an opts pointer with an accompanying opts__sz argument; the verif...

CVE-2026-72423 bpf: Guard conntrack opts error writes

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

EUVD-2026-59322

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks only the memory range described by optssz, but the wrappers...

CVE-2026-72256

CVE-2026-72256 (Linux kernel netfilter xt_cluster) : The issue arises in xt_cluster_mt() which treats any non-NULL nf_ct_get() result as a fully initialized conntrack and passes it to xt_cluster_hash(). When a template conntrack is attached to skb->_nfct before normal processing, it carries IP...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72256 netfilter: xt_cluster: reject template conntracks in hash match

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

EUVD-2026-59155

In the Linux kernel, the following vulnerability has been resolved: netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to xtclusterhash. This causes a state confusion bug when the raw table C...

CVE-2026-72253

Summary (CVE-2026-72253) : In the Linux kernel, the netfilter nf_conntrack_sip path is fixed to validate skb_dst() before use. The SIP helper relies on skb_dst() being present when sip_external_media is enabled, but tc ingress and Open vSwitch may not guarantee routing information, so the toggle ...

CVE-2026-72247

The CVE-2026-72247 issue affects the Linux kernel netfilter nf_conncount dedup logic. Root cause: in __nf_conncount_add(), the code used zone->dir (a u8 bitmask) as the direction argument to nf_ct_zone_id()/nf_ct_zone_equal(), which misinterpreted the direction and could cause incorrect zone I...

EUVD-2026-59146

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...

PT-2026-72435

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf conncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nf conncount add decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count...

PT-2026-72444

In the Linux kernel, the following vulnerability has been resolved: netfilter: xt cluster: reject template conntracks in hash match xt cluster mt treats any non-NULL nf ct get result as a fully initialized conntrack and passes it to xt cluster hash. This causes a state confusion bug when the raw...

PT-2026-72611

In the Linux kernel, the following vulnerability has been resolved: bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an opts sz argument. The verifier checks only the memory range described by opts sz, but the wrappers...

PT-2026-72916

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: fix skb leak on flow key update failure during ct ovs ct execute always steals or frees the skb on failure while ovs flow key update does not. So, if it fails and we return right away, the skb ends up leaked. Fi...

Linux Distros Unpatched Vulnerability : CVE-2026-72423

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf: Guard conntrack opts error writes The conntrack lookup and allocation kfuncs take an opts pointer together with an optssz argument. The verifier checks onl...

Linux Distros Unpatched Vulnerability : CVE-2026-74347

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nfcttimeout which is used by ct extension to set the cust...

RLSA-2026:49214 Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack CVE-2026-43116 kernel: fanotify: fix false...

RockyLinux 8 : kernel-rt (RLSA-2026:49213)

The remote RockyLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:49213 advisory. kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack...