UBUNTU-CVE-2026-72018

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

CVE-2026-74397 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

CVE-2026-74397 IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

EUVD-2026-59544

In the Linux kernel, the following vulnerability has been resolved: IB/mlx5: Fix transport-domain rollback and initialize lb mutex earlier mlx5iballoctransportdomain allocates a transport domain and then may fail in mlx5ibenablelb. In that case, the allocated TD is leaked. Fix this by deallocatin...

EUVD-2026-59117

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

CVE-2026-72018 dibs: loopback: validate offset and size in move_data()

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

CVE-2026-72018

CVE-2026-72018 affects the Linux kernel loopback path in move_data(), where a memcpy into the registered DMB can overflow when offset+size exceeds the DMB length. The issue arises because the software loopback lacks native hardware bounds checks, unlike real ISM hardware, enabling a peer-supplied...

CVE-2026-72018 dibs: loopback: validate offset and size in move_data()

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

PT-2026-72207

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An out-of-bounds write exists in the dibs loopback driver, which enables Shared Memory Communications Direct SMC-D on standard x86 Linux systems without IBM Z hardware. The issue occurs...

CVE-2026-74513: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under dmbhtlock, drop the lock and only then operate on the node's refcount...

CVE-2026-72018: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dibs: loopback: validate offset and size in movedata The loopback movedata performs a memcpy into the registered DMB without checking whether offset + size exceeds the DMB length. Unlike real ISM hardware, which enforces memory...

Linux Distros Unpatched Vulnerability : CVE-2026-74513

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dibs: fix use-after-free of dmbnode in loopback attach/detach/unregister dibsloattachdmb, dibslodetachdmb and dibslounregisterdmb look up the dmbnode under...

PT-2026-72965

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the dibs loopback attach, detach, and unregister processes. The functions dibs lo attach dmb, dibs lo detach dmb, and dibs lo unregister dmb look up the...

CVE-2026-73530

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73530

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-73530 Flyto2 Core < 2.28.0 SSRF Guard Bypass via is_private_ip()

Flyto2 Core before 2.28.0 contains a server-side request forgery guard bypass vulnerability that allows attackers to reach internal services by supplying URLs using the unblocked IPv6 address :: which the kernel routes to loopback identically to 0.0.0.0. Attackers can submit requests or trigger 3...

CVE-2026-49857

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

EUVD-2026-58054

auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in assertSafeUrl src/security.ts to block requests to private and loopback addresses. However, the isPrivateV6 function fails to detect IPv4-mapped IPv6...

CVE-2026-49857

auth-fetch-mcp has an SSRF protection bypass via IPv4-mapped IPv6 loopback. The root cause is in isPrivateV6() handling of hex-normalized IPv4-mapped addresses; input like http://[::ffff:127.0.0.1]:PORT/ becomes http://[::ffff:7f00:1]:PORT/ and net.isIPv4 returns false, allowing requests to priva...