EUVD-2026-103649

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when learning local endpoint struct ovpnbind is published through peer-bind with RCU, but local endpoint learning updates bind-local in place under peer-lock. UDP TX reads the field without that lock. In...

CVE-2026-98604

A vulnerability in the Linux kernel involves how struct ovpn_bind is handled during local endpoint learning. While the structure is published via peer->bind using RCU , the bind->local field is updated in place under peer->lock. Because UDP TX reads this field without acquiring that lock...

CVE-2026-98603

A vulnerability exists in the Linux kernel where the UDP output fallback clears bind->local in place when a remembered source address is no longer usable. Because the bind is RCU-published and read locklessly by concurrent TX, an IPv6 reader can observe a torn address . To resolve this, the ke...

CVE-2026-98603 ovpn: replace bind when clearing stale local source

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

EUVD-2026-103648

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

CVE-2026-98603 ovpn: replace bind when clearing stale local source

In the Linux kernel, the following vulnerability has been resolved: ovpn: replace bind when clearing stale local source The UDP output fallback clears bind-local in place when the remembered source address is no longer usable. The bind is RCU-published and read locklessly by concurrent TX, so an...

CVE-2026-98598

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98598

The Linux kernel contains an IPv6 vulnerability where rt6_insert_exception() could successfully create a new exception for a dying fib6_info because the FIB6_EXCEPTION_BUCKET_FLUSHED bit was not being set correctly during certain removal sequences. This flaw creates a reference cycle between the ...

CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98598 ipv6: Prevent rt6_insert_exception() for dying fib6_info.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Prevent rt6insertexception for dying fib6info. Before the cited commit, fib6nhflushexceptions always set from-exceptionbucketflushed = 1 under rt6exceptionlock to prevent rt6insertexception from inserting a new exception fo...

CVE-2026-98596 ipv6: Fix dst leak for uncached routes.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98596 ipv6: Fix dst leak for uncached routes.

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

EUVD-2026-103641

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix dst leak for uncached routes. ip6routeoutputflags, ip6rtputflags, and ip6dstcheck detect an uncached route by listempty&rt-dst.rtuncached, which replaced the static DSTNOCACHE flag check in commit a4c2fd7f7891 "net:...

CVE-2026-98596

The Linux kernel contains a vulnerability where a race condition occurs during the unregistration of a device. Specifically, when rt6_uncached_list_flush_dev() unlinks uncached routes using list_del_init(), a concurrent execution can cause list_empty() to evaluate as true prematurely. This leads ...

CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

EUVD-2026-103618

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

CVE-2026-98573

The Linux kernel is vulnerable to an underflow in skb_checksum_setup_ipv6() within the net: skbuff component. The skb_maybe_pull_tail() function fails to ensure that the max argument is at least skb_headlen(skb), leading to a wrap-around to a negative delta when parsing IPv6 extension headers on ...

CVE-2026-98573 net: skbuff: fix pull-bound underflow in skb_checksum_setup_ipv6()

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: fix pull-bound underflow in skbchecksumsetupipv6 skbmaybepulltail subtracts skbheadlenskb from the unsigned max argument and passes the result to pskbpulltail as a signed int. The function does not ensure that max is...

CVE-2026-98570

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...

CVE-2026-98570 net: ipv6: keep room for the mac header in dst_dev_overhead()

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: keep room for the mac header in dstdevoverhead The seg6, ioam6 and rpl lwtunnels size their skbcowhead request as the length they are about to push plus dstdevoverhead, then push the new headers and rebuild the mac...