CVE-2026-93226 ipv6: use RCU iterator to dump route exceptions

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

CVE-2026-93226 ipv6: use RCU iterator to dump route exceptions

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

CVE-2026-93226

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

USN-8819-1 linux, linux-hwe, linux-kvm vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

USN-8819-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - Network file system NFS server daemon; - IPv6 networking; - Netfilter; CVE-2025-38724, CVE-2026-53131, CVE-2026-532...

fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization

A flaw was found in fast-uri, a URI parser for Node.js. Its custom parser for bracketed IPv6 literals does not fully validate the IPv6 grammar, allowing invalid trailing text in an authority to be silently discarded. This can lead to a malformed, attacker-controlled host being normalized into a...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result The fib6rulesuppress function drops a suppressed route using ip6rtput Flags, but leaves res-rt6 pointing to the released rt6info. If no subsequent rule provides a replacement,...

ROS-20260924-73-0045

The vulnerability of the ip6makeskb function in the net/ipv6/ip6output.c module of the Linux operating system’s IPv6 kernel implementation is related to the use of uninitialized variables. Exploiting this vulnerability could allow an attacker to cause a service failure...

CVE-2026-85738: Server-Side Request Forgery (SSRF)

TREK is a collaborative travel planner. Prior to 3.4.0, the checkSsrf logic in server/src/utils/ssrfGuard.ts does not recognize NAT64, 6to4, or Teredo IPv6 transition addresses that encode an IPv4 destination. An authenticated user who controls a DNS record can supply a URL whose AAAA result is a...

CVE-2026-97472: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire and...

PT-2026-98287

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description The FastCGI client access check for IPv6 addresses incorrectly compares only the first 12 bytes of a 16-byte address. This causes the listen.allowed clients chec...

PT-2026-98091

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 address configuration where the kernel fails to generate temporary privacy addresses RFC 8981 after a router temporarily deprecates and then restores an IPv6...

PT-2026-104917

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire and...

CVE-2026-93226

In the Linux kernel, the following vulnerability has been resolved: ipv6: use RCU iterator to dump route exceptions rt6nhdumpexceptions uses hlistforeachentry to iterate over RCU-protected exception lists. The caller holds rcureadlock, but does not hold rt6exceptionlock, so rt6insertexception can...

Linux Distros Unpatched Vulnerability : CVE-2026-97472

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix either by sending a Router Advertisemen...

PT-2026-97893

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.0-rc7 Description A data race exists in the IPv6 implementation of the Linux kernel. The function rt6 nh dump exceptions uses hlist for each entry to iterate over RCU-protected exception lists while holding r...

CVE-2026-97472

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire and...

Security Bulletin: This Power System update is being released to address CVE-2026-53006

Summary The Linux kernel is used by the Virtualization Management Interface in PowerVM to support network communication with the Hardware Management Console. This bulletin provides a remediation for the impacted vulnerability, CVE-2026-53006, by upgrading PowerVM and thus addressing the exposure ...

php: php: Access control bypass via partial IPv6 address comparison

A flaw was found in PHP. The access control check for Internet Protocol version 6 IPv6 addresses in the FastCGI implementation compares only the first 12 bytes of a 16-byte address instead of the complete address. An attacker on an adjacent network with an address sharing the first 96 bits with a...

CVE-2026-71855

A flaw was found in Suricata. This flaw allows a remote attacker to cause an IPv4 and IPv6 flow to be treated as identical due to a hash collision. This occurs when their raw address words, ports, protocol, VLAN, recursion level, live device, and hash bucket align, without proper comparison of th...