kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nftinner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset innerthoff becomes desynchronized from the Layer 4 protocol l4proto. A remot...

kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option CIPSO IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 IC...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

CVE-2026-68477

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. This vulnerability arises from incorrect IPv6 transport offsets, where TCP application code might incorrectly assume an IPv4 network header when processing IPv6 packets. Additionally, the ICMPv6 header offset in ipvsouticmpv...

CVE-2026-74561

A flaw was found in the Linux kernel, specifically within its nexthop component responsible for network routing. A timing issue, known as a race condition, allows the system to access memory after it has been freed. This occurs when the kernel attempts to flush its routing cache while other...

ip-address: ip-address: Server-Side Request Forgery via IPv4-mapped/NAT64 IPv6 address misclassification

A flaw was found in the ip-address library. This library, used for parsing and manipulating IPv4 and IPv6 addresses in JavaScript, is vulnerable to Server-Side Request Forgery SSRF due to incorrect classification of IPv4-mapped/NAT64 IPv6 addresses. An attacker could exploit this misclassificatio...

kernel: ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()

A flaw was found in the Linux kernel's IPv6 ICMP error generation. A remote attacker could send a specially crafted IPv4 ICMP error packet with a Common Internet Protocol Security Option CIPSO IP option. This could lead to incorrect handling of packet control block data when generating an IPv6 IC...

kernel: netfilter: flowtable: strictly check for maximum number of actions

A flaw was found in the Netfilter flowtable component of the Linux kernel. This vulnerability occurs because the system does not strictly check the maximum number of hardware offload actions for IPv6, allowing it to process more actions than supported. This could potentially lead to system...

kernel: netfilter: nft_inner: Fix IPv6 inner_thoff desync

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nftinner module. This vulnerability arises from an incorrect handling of IPv6 inner packet processing, where the transport header offset innerthoff becomes desynchronized from the Layer 4 protocol l4proto. A remot...

CVE-2026-74562

A flaw was found in the Linux kernel's nexthop component. A race condition exists where internal lists are walked without proper locking during nexthop replacement and route deletion. A local attacker could exploit this by concurrently manipulating IPv6 routes, leading to a use-after-free...

CVE-2026-74579

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftpayload: fix mask build for partial field offload nftpayloadoffloadmask builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match fieldlen = 16,...

BIT-MASTODON-2026-72916 Mastodon: SSRF Protection Bypass via IPv4-compatible IPv6 Addresses

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, PrivateAddressCheck.privateaddress? in app/lib/privateaddresscheck.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with...

CVE-2026-74579 netfilter: nft_payload: fix mask build for partial field offload

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftpayload: fix mask build for partial field offload nftpayloadoffloadmask builds the offload match mask for a payload expression that covers only part of a header field. For a partial IPv6 address match fieldlen = 16,...

CVE-2026-74579

CVE-2026-74579 is a vulnerability in the Linux kernel 's netfilter subsystem, specifically in the nft_payload_offload_mask() function within nft_payload.c. When building an offload match mask for a partial IPv6 address match (e.g., field_len=16, priv_len=1), the code performs a shift of 1 <

PT-2026-73373

Mastodon is a free, open-source social network server based on ActivityPub. Prior to 4.4.21, 4.5.14, 4.6.4, and 4.7.0, PrivateAddressCheck.private address? in app/lib/private address check.rb normalized IPv4-mapped IPv6 addresses but did not recognize IPv4-compatible IPv6 addresses with IPAddripv...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100114)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100114 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: sit: reload inner IPv6 header after GSO offloads ipip6tunnelxmit caches the inner IPv6 head...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100561)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100561 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6hopjumbo ipv6hopjumbo calls pskbtrimrcsum, which can...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099968)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099968 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6rcv Caching saddr and daddr before pskbpull is problematic since...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099894)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099894 advisory. In the Linux kernel, the following vulnerability has been resolved: net: ipv6: flowlabel: defer exclusive option free until RCU teardown ip6flseqshow walks the globa...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100547 advisory. In the Linux kernel, the following vulnerability has been resolved: nexthop: fix IPv6 route referencing IPv4 nexthop syzbot reported a panic 1 2. When an IPv6 nextho...