477018 matches found
CVE-2026-72251 netfilter: nf_nat_sip: reload possible stale data pointer
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...
CVE-2026-72251
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnatsip: reload possible stale data pointer quoting sashiko: ------------------------------------------------------------------------ .. noticed a potential memory bug and header corruption involving the SIP NAT helpe...
CVE-2026-72250 netfilter: nf_conntrack_reasm: guard mac_header adjustment after IPv6 defrag
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...
EUVD-2026-59149
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackreasm: guard macheader adjustment after IPv6 defrag nfctfrag6reasm slides the packet head forward to drop the IPv6 fragment header and then unconditionally advances skb-macheader: skb-macheader += sizeofstru...
CVE-2026-72251
CVE-2026-72251 concerns the Linux kernel netfilter nf_nat_sip path. The issue is a memory-pointer/buffer handling flaw: if skb_ensure_writable() reallocates a cloned/fragmented skb, nf_nat_sip() may not update the destination pointer (dptr ) to the new buffer, risking a stale data pointer and pot...
CVE-2026-72249
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...
CVE-2026-72249 netfilter: flowtable: use dst in this direction when pushing IPIP header
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...
CVE-2026-72249 netfilter: flowtable: use dst in this direction when pushing IPIP header
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...
EUVD-2026-59148
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: use dst in this direction when pushing IPIP header When pushing the IPIP header, the route of the other direction is used to calculate the headroom, use the route in this direction. Accessing the other tuple...
CVE-2026-72249
The CVE-2026-72249 entry documents a Linux kernel netfilter flowtable bug: when pushing IPIP headers, the code uses the wrong direction’s route to calculate headroom, causing iph->frag_off and headroom handling to be incorrect. The issue arises from accessing the other tuple to set IP source/d...
CVE-2026-72248
The CVE-2026-72248 entry pertains to the Linux kernel netfilter flowtable: IPIP tunnels with direct xmit can crash the tunnel transmit path due to missing dst_entry when checking headroom and setting iph->frag_off. The workaround/patch moves dst_cache and dst_cookie out of the runtime union so...
CVE-2026-72248 netfilter: flowtable: support IPIP tunnel with direct xmit
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...
EUVD-2026-59147
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...
CVE-2026-72248 netfilter: flowtable: support IPIP tunnel with direct xmit
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: support IPIP tunnel with direct xmit The combination of IPIP tunnel with direct xmit, eg. bridge device, breaks because no dstentry is provided to check the skb headroom and to set the iph-fragoff field. Thi...
CVE-2026-72247
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...
CVE-2026-72247 netfilter: nf_conncount: fix zone comparison in tuple dedup
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...
CVE-2026-72247
The CVE-2026-72247 issue affects the Linux kernel netfilter nf_conncount dedup logic. Root cause: in __nf_conncount_add(), the code used zone->dir (a u8 bitmask) as the direction argument to nf_ct_zone_id()/nf_ct_zone_equal(), which misinterpreted the direction and could cause incorrect zone I...
EUVD-2026-59146
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconncount: fix zone comparison in tuple dedup The "already exists" dedup logic in nfconncountadd decides whether a connection has already been counted and can be skipped instead of incrementing the connlimit count. I...