EUVD-2026-63384

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation...

CVE-2026-16924

IBM AIX 7.2, 7.3, and PowerVM VIOS 4.1 contain a flaw in IPsec decapsulation where improper memory offset calculation allows a remote, unauthenticated attacker to trigger a denial of service (CVSS 7.5 HIGH). No exploitation or patch details are provided in the documents; a reference link to IBM s...

PT-2026-79030

IBM AIX 7.2, and 7.3 and IBM PowerVM VIOS 4.1 could allow a remote attacker to cause a denial of service due to an improper calculation of a memory offset during IPsec decapsulation...

CVE-2026-75595 Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext

Netty is an asynchronous, event-driven network application framework. Prior to 4.1.137.Fina and 4.2.17.Final, io.netty.handler.ssl.SslClientHelloHandlerdecode checks the wrong offset before reading the four-byte TLS handshake header, so a ClientHello whose handshake header spans records can cause...

Linux Distros Unpatched Vulnerability : CVE-2026-68477

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 networ...

CVE-2026-72021

A flaw was found in the kernel's IP Virtual Server IPVS component. This vulnerability occurs when the setsctpstate function incorrectly calculates the offset for Stream Control Transmission Protocol SCTP chunk headers in IPv6 packets that contain extension headers. A remote attacker could exploit...

CVE-2026-68477

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. This vulnerability arises from incorrect IPv6 transport offsets, where TCP application code might incorrectly assume an IPv4 network header when processing IPv6 packets. Additionally, the ICMPv6 header offset in ipvsouticmpv...

CVE-2026-74474

In the Linux kernel, the following vulnerability has been resolved: vxlan: use pskbnetworkmaypull for transmit path header pulls In vxlanxmit, arpreduce, and vxlanmdbentryskbget, pskbmaypull was being called to verify the availability of network layer headers ARP, IPv6/ND, IP/IPv6 MDB keys...

CVE-2026-74474

CVE-2026-74474 pertains to the Linux kernel where the transmit path in VXLAN code (vxlan_xmit, arp_reduce, vxlan_mdb_entry_skb_get) used pskb_may_pull() to verify network-layer header availability. Because skb->data points to the MAC header (offset ~ ETH_HLEN), pskb_may_pull() could fail to ac...

CVE-2026-72407

In the Linux kernel, the following vulnerability has been resolved: geneve: validate inner network offset in genevegrocomplete Even with both paths gated on gs-grohint, genevegrocomplete re-derives the inner dispatch type and length from the packet and the current gs-grohint, independently of...

CVE-2026-72442

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: fix and simplify IP6IP6 tunnel handling Fix nfflowip6tunnelproto to use pskbmaypull instead of skbheaderpointer to ensure the outer IPv6 header is in the skb headroom, which is required for subsequent packet...

CVE-2026-72107

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72021

In the Linux kernel, the following vulnerability has been resolved: ipvs: use parsed transport offset in SCTP state lookup setsctpstate reads the SCTP chunk header again in order to drive the IPVS SCTP state table. For IPv6 it computes the offset with sizeofstruct ipv6hdr, while the surrounding...

CVE-2026-72135

In the Linux kernel, the following vulnerability has been resolved: tpm: Make the TPM character devices non-seekable The TPM character devices expose a sequential command/response interface, but their open handlers leave FMODEPREAD and FMODEPWRITE enabled. After a command leaves a response pendin...

UBUNTU-CVE-2026-72129

In the Linux kernel, the following vulnerability has been resolved: nvmet-rdma: handle inline data with a nonzero offset nvmetrdmauseinlinesg maps the host-controlled inline data offset into the per-command inline scatterlist. The bounds check admits any offset with off + len offset = off;...

CVE-2026-72143

In the Linux kernel, the following vulnerability has been resolved: platform/x86: ISST: Restore SST-PP control to all domains The SST-PP control offset is only restored to power domain 0 after resume. During suspend, control values are read and stored for all power domains. Use pdinfo-sstbase...

UBUNTU-CVE-2026-72107

In the Linux kernel, the following vulnerability has been resolved: dm era: fix out-of-bounds memory access for non-zero start sector dm-era tracks writes in target-relative blocks, but eramap calculates the writeset block before applying the target offset. Tables with a non-zero start sector can...

UBUNTU-CVE-2026-68477

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...

CVE-2026-68477

In the Linux kernel, the following vulnerability has been resolved: ipvs: fix more places with wrong ipv6 transport offsets Sashiko reports for more incorrect IPv6 transport offsets. The app code for TCP was assuming IPv4 network header even after the ipvsh argument was provided. This can cause...