Linux Distros Unpatched Vulnerability : CVE-2026-98432

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipv4: free inetopt and ireqopt after an RCU grace period tcpv4synrecvsock transfers ownership of ireq-ireqopt to the child socket newinet-inetopt without copyin...

kernel: net/sched: act_ct: Only release RCU read lock after ct_ft

A flaw was found in the Linux kernel. A race condition in the actct module, specifically during the flow table lookup, can lead to a Use-After-Free UAF vulnerability. This occurs because a critical lock is released prematurely, allowing a memory object to be freed while still in use. An attacker...

kernel: net/iucv: fix use-after-free of a severed iucv_path

A flaw was found in the Linux kernel. This use-after-free vulnerability exists in the net/iucv component. When a peer severs a connection, message notifications that still reference the freed connection path remain in a queue. A subsequent attempt to process these stale notifications can lead to...

kernel: net/sched: cls_route: fix fastmap use-after-free on filter

A flaw was found in the Linux kernel's net/sched: clsroute component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packe...

kernel: net/sched: cls_route: fix fastmap use-after-free on filter

A flaw was found in the Linux kernel's net/sched: clsroute component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packe...

CVE-2026-110310

The Amazon S3 Encryption Client for .NET is vulnerable to an RSA PKCS#1 v1.5 padding oracle attack. A remote user capable of reading encrypted objects in an S3 bucket can force a padding downgrade by modifying an object's metadata to use the legacy PKCS#1 v1.5 scheme. This vulnerability allows th...

CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-110310 RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET

A remote user who can read encrypted objects in the S3 bucket can force a padding downgrade by altering the padding scheme recorded in an object's metadata to legacy PKCS1 v1.5. Since this padding scheme is susceptible to the well-known Bleichenbacher attack, the user can use a PKCS1 v1.5 padding...

CVE-2026-66822

Insertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of us...

CVE-2026-69651

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-58280

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network...

CVE-2026-19673

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-19673

ethernetrecv in subsys/net/l2/ethernet/ethernet.c validates only that the first netbuf of a received frame holds a plain 14-byte struct netethhdr. When the ethertype is 0x8100 and VLAN is enabled on the interface, the same buffer is reinterpreted as the 18-byte struct netethvlanhdr without...

CVE-2026-98427

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrtcount after the previous drop, using the configured interval codelparams.interval. For very small intervals...

AZL-108108 CVE-2026-98427 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrtcount after the previous drop, using the configured interval codelparams.interval. For very small intervals...

DEBIAN-CVE-2026-98427

In the Linux kernel, the following vulnerability has been resolved: net/sched: codel: bound the dropping loop per dequeue call The CoDel control law schedules the next drop one interval/sqrtcount after the previous drop, using the configured interval codelparams.interval. For very small intervals...

DEBIAN-CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

DEBIAN-CVE-2026-98401

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

UBUNTU-CVE-2026-98401

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: fix stale transport header during tunnel decapsulation Syzbot reported a crash in qdiscpktlensegsinit caused by a stale transportheader offset after tunnel decapsulation. BUG: unable to handle page fault for addres...

UBUNTU-CVE-2026-98393

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: Fix UDP length overflow with PMTU discover and big MTU This commit bounds cork-base.fragsize to IPMAXMTU to avoid a possible overflow of UDP length that triggers a WARN in udpsetlenshort when setsockopt IPMTUDISCOVER i...