Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: In the inet section, RAW sockets using IPPROTORAW must drop incoming ICMP packets. Yizhou Zhao reported that simply having a RAW socket with the protocol set to IPPROTORAW 255 was dangerous. The code example: socketAFINET, SOCKRA...

kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err()

A flaw was found in the Linux kernel's IPv6 tunnel implementation. A remote attacker could exploit this flaw by sending malicious ICMPv6 error messages to cause a stack-based buffer overflow in the kernel's IPv4-over-IPv6 tunnel error handling code. This could result in a kernel crash denial of...

Security update for openvswitch

This update for openvswitch fixes the following issues CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498. CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing bsc1262499. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

Security update for openvswitch3

This update for openvswitch3 fixes the following issues CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498. CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing bsc1262499. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

Security update for openvswitch

This update for openvswitch fixes the following issues CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498. CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing bsc1262499. Patch Instructions: To install this SUSE update use the SUSE recommended installation...

SUSE SLES15: libopenvswitch-3_5-0 / libovn-25_03-0 / openvswitch / etc (SUSE-SU-2026:2463-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2463-1 advisory. This update for openvswitch fixes the following issues Update ovn to 25.03.3: - CVE-2026-5265: heap over-read in ICMP error respons...

SUSE-SU-2026:2463-1 Security update for openvswitch

This update for openvswitch fixes the following issues Update ovn to 25.03.3: - CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498. - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing bsc1262499...

EUVD-2026-37893

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

CVE-2026-12539 Docker Sandboxes ICMP egress restriction bypass after daemon restart

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

CVE-2026-12539

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

CVE-2026-12539

Docker Sandboxes (sbx) ICMP egress restriction can be bypassed after daemon restart. The issue arises because the authorizer is applied only at network creation and is not re-applied to networks rebuilt from disk on restart, allowing a restart-surviving sandbox to forward ICMP to arbitrary hosts....

CVE-2026-12539: Improper Restriction of Communication Channel to Intended Endpoints

Docker Sandboxes sbx blocks ICMP egress with an authorizer applied only at network-creation time, and does not re-apply it to networks rebuilt from disk when the Docker daemon restarts, so a restart-surviving sandbox forwards ICMP to arbitrary hosts. A workload inside a sandbox, which the threat...

PT-2026-50676

Name of the Vulnerable Software and Affected Versions Docker Sandboxes affected versions not specified Description Docker Sandboxes sbx fail to re-apply the ICMP egress authorizer to networks rebuilt from disk after a Docker daemon restart. This allows a restart-surviving sandbox to forward ICMP...

SUSE-SU-2026:22145-1 Security update for openvswitch

This update for openvswitch fixes the following issues - CVE-2026-5265: heap over-read in ICMP error response generation bsc1262498. - CVE-2026-5367: heap over-read in OVN DHCPv6 client ID processing bsc1262499. - CVE-2026-34956: Invalid memory access in conntrack FTP alg bsc1261273. Changes for...

EUVD-2026-37117

Zephyr's IPv6 Neighbor Discovery send paths netipv6sendna, netipv6sendns, netipv6sendrs in subsys/net/ip/ipv6nbr.c updated the per-interface ICMP-sent statistics by calling netpktifacepkt after netsenddatapkt had already returned successfully. On the success path the network stack owns and releas...

CVE-2026-10640

Zephyr's IPv6 Neighbor Discovery send paths netipv6sendna, netipv6sendns, netipv6sendrs in subsys/net/ip/ipv6nbr.c updated the per-interface ICMP-sent statistics by calling netpktifacepkt after netsenddatapkt had already returned successfully. On the success path the network stack owns and releas...

CVE-2026-10639

Summary: Zephyr’s native IPv4 icmpv4_handle_echo_request() can perform a use-after-free when updating per-interface statistics after sending an ICMP echo reply. The code hands the echo-reply to the TX path, which may drop the packet and free the net_pkt before the post-send stats update runs. As ...

CVE-2026-10639 Use-after-free reading `net_pkt_iface()` of a sent ICMPv4 echo-reply packet in `icmpv4_handle_echo_request()`

In Zephyr's native IPv4 stack, icmpv4handleechorequest in subsys/net/ip/icmpv4.c builds an echo-reply packet reply, hands it to nettrysenddata, and then, on success, calls netstatsupdateicmpsentnetpktifacereply. nettrysenddata transfers ownership of reply to the TX path netiftryqueuetx - netiftx ...

PT-2026-49712

Name of the Vulnerable Software and Affected Versions Zephyr versions 1.14 through 4.4.0 Description A use-after-free issue exists in the native IPv4 stack within the icmpv4 handle echo request function in subsys/net/ip/icmpv4.c. The function creates an echo-reply packet and passes it to net try...

PT-2026-49711

subsys/net/ip/icmpv6.c reads the network interface from a net pkt after that packet has been handed to net try send data. In icmpv6 handle echo request and net icmpv6 send error, the post-send statistics update calls net pkt ifacereply/net pkt ifacepkt on the just-sent packet. The send path net t...