Important: Red Hat Security Advisory: OpenShift Container Platform 4.14.72 packages and security update

Red Hat OpenShift Container Platform release 4.14.72 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.14. Red Hat Product Security has rated this update as having a...

CVE-2026-18664

When ranges are used for access control i.e. of the form 1.2.3.4-1.2.3.25, because NSD wrongly compares the IP address with the range on little endian systems, IPs that were meant to be allowed may be denied, and, IPs that were meant to be denied access could be allowed. An IPv4 address is compar...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabilit...

kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...

CVE-2026-52776

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

kernel: net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

A flaw was found in the Linux kernel's IPv6 networking implementation, specifically within the seg6 and rpl lwtunnels. A race condition can occur when handling destination cache entries, where a NOREF no reference destination object is used after it has been freed. This use-after-free vulnerabili...

CVE-2026-80347: Server-Side Request Forgery (SSRF)

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104578)

"The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104578 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104613)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104613 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matche...

AlmaLinux 9 : grafana (ALSA-2026:58982)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:58982 advisory. grafana: Grafana: Privilege escalation via dashboard overwrite CVE-2026-33377 grafana: Grafana Auth Proxy: Unauthorized access due to incorrect IPv6...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098836)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098836 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU in ip6xmit Use RCU in ip6xmit in order to use dstdevrcu to prevent possible UAF...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098740)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098740 advisory. In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: Fix use-after-free when processing MLD queries When processing an MLD query, a point...

RHEL 8 : kernel (RHSA-2026:59994)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:59994 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: net: ipv6: use-after-free in...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-104536)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104536 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop The ah, hbh and rt matche...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104543)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104543 advisory. In the Linux kernel, the following vulnerability has been resolved: tcp: ipv6: clamp default adverting MSS to avoid GSOBYFRAGS 0xFFFF When MTU is large,...

PT-2026-82068

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

PT-2026-82065

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104546)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104546 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6...