CVE-2026-98955

A flaw was found in the Linux kernel. An integer truncation issue in the network flow dissector component occurs when calculating transport header offsets for network packets exceeding 64 kilobytes. An attacker could exploit this flaw by transmitting specially sized network frames, causing the...

PT-2026-121927

In the Linux kernel, the following vulnerability has been resolved: flow dissector: avoid u16 truncation of skb-len when computing thoff skb flow dissect computes key control-thoff using: key control-thoff = min tu16, nhoff, skb ? skb-len : hlen; min tu16, ... casts both arguments to u16 before...

Astra Linux – vulnerability in linux-6.1, linux-6.12

In the Linux kernel, the following vulnerability has been resolved: flowdissector: do not dissect PPPoE PFC frames RFC 2516 Section 7 states that Protocol Field Compression PFC is NOT RECOMMENDED for PPPoE. In practice, pppd does not support negotiating PFC for PPPoE sessions, and the flow...

Astra Linux – Vulnerabilities in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ppp: Associating skb with a device at tx. Syzkaller triggered a flow dissector warning with the following code: c r0 = openat$ppp0xffffffffffffff9c, &0x7f0000000000, 0xc0802, 0x0 ioctl$PPPIOCNEWUNITr0, 0xc004743e,...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: prevent perpetual headroom growth The issue occurred due to the following situation: skb-data points beyond the allocated area of skb-head. This happens because the Neigh layer performs the following operation:...

Astra Linux – Vulnerabilities in Linux, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: bpf: Reject variable offset alu on PTRTOFLOWKEYS For PTRTOFLOWKEYS, the checkflowkeysaccess function only uses a fixed offset for validation. However, the variable offset ptr isn’t prohibited for this type of pointer. Therefore,...

Astra Linux – Vulnerability found in Linux 5.15, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net/core: Fixed the ETHP1588 flow dissector. When an PTP Ethernet raw frame with a size of more than 256 bytes followed by a 0xff pattern is sent to skbflowdissect, the calculation of the nhoff value is incorrect. For example,...

SUSE CVE-2026-80906

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

AZL-99579 CVE-2026-80906 affecting package kernel for versions less than 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

AZL-99629 CVE-2026-80905 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transportheader when sending VLAN-tagged frame In tapgetuserxdp, when processing a VLAN-tagged frame e.g. ETHP8021Q, skbsetnetworkheader is called first to advance networkheader past the VLAN tag to the inner...

CVE-2026-80906

CVE-2026-80906 affects the Linux kernel net: packet subsystem. In packet_parse_headers(), when handling a VLAN-tagged frame, skb_set_network_header() advances the network header past the VLAN tag before skb_probe_transport_header() is called. This leaves skb->protocol set to the outer VLAN Eth...

CVE-2026-80906 net: packet: fix wrong transport_header when sending VLAN-tagged frame

In the Linux kernel, the following vulnerability has been resolved: net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called to advance networkheader past the VLAN tag to the inner protocol...

CVE-2026-80905 net: tap: fix wrong transport_header when sending VLAN-tagged frame

In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transportheader when sending VLAN-tagged frame In tapgetuserxdp, when processing a VLAN-tagged frame e.g. ETHP8021Q, skbsetnetworkheader is called first to advance networkheader past the VLAN tag to the inner...

EUVD-2026-71664

In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transportheader when sending VLAN-tagged frame In tapgetuserxdp, when processing a VLAN-tagged frame e.g. ETHP8021Q, skbsetnetworkheader is called first to advance networkheader past the VLAN tag to the inner...

PT-2026-86196

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the tap get user xdp function when processing VLAN-tagged frames. The skb set network header function is called prematurely, advancing the network header past the VLAN...

PT-2026-86197

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists when processing VLAN-tagged frames where the transport header is incorrectly set. In the packet parse headers function, skb set network header is called to advance the...

Linux Distros Unpatched Vulnerability : CVE-2026-80906

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: packet: fix wrong transportheader when sending VLAN-tagged frame In packetparseheaders, when processing a VLAN-tagged frame, skbsetnetworkheader is called ...

CVE-2026-80905: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net: tap: fix wrong transportheader when sending VLAN-tagged frame In tapgetuserxdp, when processing a VLAN-tagged frame e.g. ETHP8021Q, skbsetnetworkheader is called first to advance networkheader past the VLAN tag to the inner...

Linux Distros Unpatched Vulnerability : CVE-2026-80905

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - net: tap: fix wrong transportheader when sending VLAN-tagged frame In tapgetuserxdp, when processing a VLAN-tagged frame e.g. ETHP8021Q, skbsetnetworkheader is...

EUVD-2026-59343

In the Linux kernel, the following vulnerability has been resolved: flowdissector: check device type before reading ETHADDRS skbflowdissect unconditionally reads 12 bytes from ethhdrskb when FLOWDISSECTORKEYETHADDRS is requested. This assumes the skb has a valid Ethernet header at macheader, whic...