Linux Distros Unpatched Vulnerability : CVE-2026-64114

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum,...

BIT-HUBBLE-RELAY-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

BIT-CILIUM-2026-56743 Cilium may unexpectedly allow ingress traffic from the local namespace when a Kubernetes NetworkPolicy is configured with an ipBlock match

Cilium is a networking, observability, and security solution. From 1.19.0 to 1.19.4, standard Kubernetes NetworkPolicy specifications using CIDR-based ipBlock rules without pod or namespace selectors erroneously generate a wildcard namespace allow rule when Cilium is configured with a custom...

SUSE CVE-2026-63829

In the Linux kernel, the following vulnerability has been resolved: net: ipgre: require CAPNETADMIN in the device netns for changelink A tunnel changelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other...

CVE-2026-63969

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63912

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-64116

In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: add NULL check for idev in ipv6hopioam Reported by Sashiko: The function ipv6hopioam accesses in6devgetskb-dev-cnf.ioam6enabled without validating the returned idev pointer. Because addrconfifdown can concurrently cle...

CVE-2026-64114 ipv4: raw: reject IP_HDRINCL packets with ihl < 5

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IPHDRINCL packets with ihl ihl 4; err = -EINVAL; if iphlen length goto errorfree; if iphlen = sizeofiph / fix up saddr, totlen, id, csum, transportheader / It does not, however, reject ihl = sizeofiph" branch is...

CVE-2026-63993 vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu()

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached iphdr value after skbtunnelcheckpmtu skbtunnelcheckpmtu can change skb-head. Reusing oldiph afer skbtunnelcheckpmtu can cause an UAF. Use instead iphdrskb as done in drivers/net/bareudp.c and...

EUVD-2026-45566

In the Linux kernel, the following vulnerability has been resolved: vxlan: do not reuse cached iphdr value after skbtunnelcheckpmtu skbtunnelcheckpmtu can change skb-head. Reusing oldiph afer skbtunnelcheckpmtu can cause an UAF. Use instead iphdrskb as done in drivers/net/bareudp.c and...

CVE-2026-63993

CVE-2026-63993 corresponds to a Linux kernel issue in VXLAN handling: skb_tunnel_check_pmtu() may modify skb-&gt;head, causing a stale ip_hdr() reference to be reused and potentially leading to use-after-free (UAF). The advised remediation is to use ip_hdr(skb) instead of the cached value, as imp...

CVE-2026-63994 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

CVE-2026-63994

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

CVE-2026-63994 tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()

In the Linux kernel, the following vulnerability has been resolved: tunnels: load network headers after skbcow in iptunnelpmtudbuildicmpv6 Sashiko found that iptunnelpmtudbuildicmp and iptunnelpmtudbuildicmpv6 were caching iphdr and ipv6hdr before an skbcow call which can reallocate skb-head. Fix...

CVE-2026-63984 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63912

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

EUVD-2026-45678

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

CVE-2026-63905

In the Linux kernel, the following vulnerability has been resolved: usbip: vudc: Fix use after free bug in vudcremove due to race condition This patch follows up Zheng Wang's 2023 report of a use-after-free in vudcremove. The original thread stalled on Shuah Khan's request for runtime testing of...

CVE-2026-63870

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...