CVE-2026-72054

A flaw was found in the Linux kernel's ipvti component. An attacker with CAPNETADMIN privileges in one network namespace netns but not in another, can exploit an insufficient capability check in the vtichangelink function. This allows them to rewrite a Virtual Tunnel Interface VTI tunnel that...

CVE-2026-72053

A flaw was found in the Linux kernel's ipip networking component. A local attacker with certain network administration capabilities in one network namespace could exploit an insufficient permission check in the ipipchangelink function. This could allow them to modify the configuration of a networ...

CVE-2026-72051

A flaw was found in the Linux kernel's IPv6 tunnel ip6tunnel handling. A local attacker, privileged in one network namespace but not another, could exploit a missing capability check in the ip6tnlchangelink function. This vulnerability allows the attacker to modify an IPv6 tunnel residing in a...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099759)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099759 advisory. In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100767)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100767 advisory. In the Linux kernel, the following vulnerability has been resolved: ppp: require CAPNETADMIN in target netns for unattached ioctls /dev/ppp open is currently...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100326 advisory. In the Linux kernel, the following vulnerability has been resolved: virtionet: Fix UAF on dstops when IFFXMITDSTRELEASE is cleared and napitx is false A UAF issue...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099928)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099928 advisory. In the Linux kernel, the following vulnerability has been resolved: ppp: require CAPNETADMIN in target netns for unattached ioctls /dev/ppp open is currently...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74544

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsu32: validate offshift to prevent shift-out-of-bounds u32change copies the user-provided tcu32sel.offshift unsigned char, 0-255 into the kernel knode object without bounds validation. When a packet later hits...

CVE-2026-74565

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftables: make nftobject rhltable per table The nftobject rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nftobjdestroy releases the...

CVE-2026-74290

In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: Dont expose folded kernel pointers The flow classifier falls back to addrfold for fields that are missing from packet headers. In map mode, userspace controls mask, xor, rshift, addend and divisor, and can...

CVE-2026-74259

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-72430

In the Linux kernel, the following vulnerability has been resolved: net/sched: actct: fix nfconnlabels leak on two error paths tcfctfillparams calls nfconnlabelsget setting putlabels when TCACTLABELS is present, but two later error sites use a bare return instead of "goto err", skipping the err:...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

EUVD-2026-59574

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74427

In the Linux kernel, the following vulnerability has been resolved: afs: Fix netns teardown to cancel the preallocation charger Fix the teardown of an afs network namespace to make sure it cancels the work item that keeps the preallocated rxrpc call/conn/peer queue charged before incoming calls a...

CVE-2026-74259 cifs: remove all cifs files before kill super

In the Linux kernel, the following vulnerability has been resolved: cifs: remove all cifs files before kill super Cifs files may be put into fileinfoputwq during umounting cifs. After umount done, cifsFileInfoputfinal is called, which cause following BUG: BUG: kernel NULL pointer dereference,...

EUVD-2026-59012

In the Linux kernel, the following vulnerability has been resolved: net: ipvti: require CAPNETADMIN in the device netns for changelink vtichangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

EUVD-2026-59011

In the Linux kernel, the following vulnerability has been resolved: net: ipip: require CAPNETADMIN in the device netns for changelink ipipchangelink operates on at most two netns, devnetdev and the tunnel link netns t-net. They differ once the device is created in or moved to a netns other than t...

PT-2026-72996

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the cls u32 component where the u32 change function copies a user-provided tc u32 sel.offshift value into a kernel knode object without proper bounds validation. When ...