CVE-2026-92542

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

CVE-2026-92542

A vulnerability in Linux Swarm allows for blind VXLAN injection into encrypted overlay networks. The root cause is that firewall rules marking VXLAN datagrams for encryption indiscriminately match both authentic kernel-sent datagrams and forged datagrams from user processes. Specifically, any UDP...

EUVD-2026-94483

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

CVE-2026-92542: Authentication Bypass by Spoofing

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

PT-2026-107622

Name of the Vulnerable Software and Affected Versions Docker affected versions not specified Description Firewall rules designed to mark VXLAN datagrams for encryption fail to distinguish between authentic datagrams sent from the kernel and forged datagrams sent by user processes. This allows any...

Linux Distros Unpatched Vulnerability : CVE-2026-92542

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sen...

CVE-2026-90049

A flaw was found in the Linux kernel's networking subsystem. When the skbzerocopy function fails to orphan fragments, it incorrectly calls skbtxerror on the source skbuff skb. This premature completion of the zerocopy user argument and clearing of the SKBFLSHAREDFRAG flag can lead to a condition...

Cisco ASA Reachable Assertion (CVE-2021-1422)

A vulnerability in the software cryptography module of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, remote attacker or an unauthenticated attacker in a man-in-the-middle position to cause an unexpected reload of the...

Cisco ASA Missing Required Cryptographic Step (CVE-2022-20742)

A vulnerability in an IPsec VPN library of Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an unauthenticated, remote attacker to read or modify data within an IPsec IKEv2 VPN tunnel. This vulnerability is due to an improper implementatio...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - In the net subsystem, do not delay the execution of dstentriesadd within dstrelease. - dstentriesadd uses data per-core that might be freed during the dismantling of ip6routenetexit, by calling dstentriesdestroy. Before...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: The “x-tunnel” structure is deleted as soon as the “x” structure is deleted. The IP-compatibility tunnels are currently being deleted from various lists and hashtables because the last user state that relied on those tunnel...

[SECURITY] Fedora 45 Update: strongswan-6.1.0-2.fc45

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel...

Rocky Linux 8 [CIQ] Security Update: kernel-rt / kernel-rt-core / kernel-rt-debug / kernel-rt-debug-core / etc Multiple Vulnerabilities (crlsa-2022_5344)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225344 advisory. kernel: buffer overflow in IPsec ESP transformation code CVE-2022-27666 kernel: out-of-bounds read in fbcongetfont function CVE-2020-28915 Tenable has...

Rocky Linux 8 [CIQ] Security Update: bpftool / bpftool-debuginfo / kernel / kernel-abi-stablelists / etc Multiple Vulnerabilities (crlsa-2022_5316)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20225316 advisory. kernel: buffer overflow in IPsec ESP transformation code CVE-2022-27666 kernel: out-of-bounds read in fbcongetfont function CVE-2020-28915 Tenable has...

[SECURITY] Fedora 43 Update: NetworkManager-l2tp-1.52.6-1.fc43

This package contains software for integrating L2TP and L2TP over IPsec VPN support with the NetworkManager...

CVE-2026-98103

A flaw was found in the Linux kernel's Internet Group Management Protocol IGMP subsystem. A recursive locking condition can occur when transmitting IGMPv3 reports over network routes configured with IPsec Internet Protocol Security policies, as the kernel attempts to acquire a spinlock that is...

OESA-2026-4071 strongswan security update

The strongSwan IPsec implementation supports both the IKEv1 and IKEv2 key exchange protocols in conjunction with the native NETKEY IPsec stack of the Linux kernel. Security Fixes: In the eap-mschapv2 plugin client-side in strongSwan before 6.0.3, a malicious EAP-MSCHAPv2 server can send a crafted...

CVE-2026-14443

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential...

EUVD-2026-86457

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential...

CVE-2026-14443 Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav before 3.0.1a

Incomplete log sanitization during bulk IPsec policy collection in Brocade SANnav versions before 3.0.1a permit extension switch pre-shared keys to be written to system logs. Individuals with read access to container logs or support archives can obtain these keys, leading to the potential...