CVE-2026-68142

The CVE concerns the Linux kernel geneve driver. A local attacker with CAP_NET_ADMIN in one network namespace can bypass permission checks and modify a geneve network device in a different namespace, potentially enabling unauthorized network configuration changes or disruption. The fix gates the ...

CVE-2026-68127

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskbmaypull in checksum adjust ilacsumadjusttransport caches ip6h = ipv6hdrskb before calling pskbmaypull. On a non-linear skb whose transport header sits in a page fragment, pskbmaypull can call...

CVE-2026-68119

In the Linux kernel, the following vulnerability has been resolved: tcp: initialize standalone TCP-AO response padding tcpv4sendack and tcpv6sendresponse construct standalone TCP responses with TCP-AO options. The option length carries the actual MAC length, but the TCP header length includes the...

CVE-2026-68097

In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate ACE size against SID sub-authorities setntacldacl validates sid.numsubauth before copying an ACE, but does not verify that the declared ACE size contains all sub-authorities described by that field. An undersized...

CVE-2026-68096

In the Linux kernel, the following vulnerability has been resolved: audit: fix recursive locking deadlock in auditdupeexe A deadlock occurs in the audit subsystem when duplicating executable-related rules. When a file is moved e.g., via dorenameat2, the VFS layer locks the parent directory...

CVE-2026-68092

In the Linux kernel, the following vulnerability has been resolved: time/jiffies: Register jiffies clocksource before usage Teddy reported that a XEN HVM has a long boot delay, which was bisected to the recent enhancements to the negative motion detection. It turned out that the jiffies clocksour...

CVE-2026-68091

In the Linux kernel, the following vulnerability has been resolved: HID: wacom: stop hardware after post-start probe failures wacomparseandregister starts HID hardware before registering inputs and initializing pad LEDs/remotes. Those later steps can fail, but their error paths currently release...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

CVE-2026-68161: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: sctp: close UDP tunnel sockets during netns teardown procsctpdoudpport starts per-net SCTP UDP tunneling sockets when net.sctp.udpport is set, and stops/restarts them when the sysctl value changes. The netns exit path does not st...

CVE-2026-68386: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while skisrefcountedbound = false. Because sockmap accepts unbound UDP sockets,...

Linux Distros Unpatched Vulnerability : CVE-2026-68386

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - bpf, sockmap: Reject unhashed UDP sockets on sockmap update UDP sockets get SOCKRCUFREE set when auto-bound. This means skisrefcountedunbound = true, while...

CVE-2026-8718: Out-of-bounds Write

tlsoptdtlspeerconnectionidvalueget in subsys/net/lib/sockets/socketstls.c, which handles getsockoptSOLTLS, TLSDTLSPEERCIDVALUE, passed the caller-supplied optval directly to mbedtlssslgetpeercid without verifying the buffer was at least MBEDTLSSSLCIDOUTLENMAX default 32 bytes. mbedtlssslgetpeerci...

Exploit for Improper Locking in Linux Linux_Kernel

Linux Kernel Vulnerability Analysis: CVE-2021-26708 Overvi...

OESA-2026-3302 kernel security update

The Linux Kernel, the operating system core itself. Security Fixes: In the Linux kernel, the following vulnerability has been resolved: inet: RAW sockets using IPPROTORAW MUST drop incoming ICMP Yizhou Zhao reported that simply having one RAW socket on protocol IPPROTORAW 255 was dangerous...

SUSE SLES15: libpcp-devel / libpcp3 / libpcp_gui2 / libpcp_import1 / libpcp_mmv1 / etc (SUSE-SU-2026:3506-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3506-1 advisory. - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot...

Security update for pcp

This update for pcp fixes the following issues: CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. CVE-2026-16527: missing authenticatio...

SUSE-SU-2026:3507-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

SUSE-SU-2026:3505-1 Security update for pcp

This update for pcp fixes the following issues: - CVE-2026-16524: command injection in linuxsockets PMDA via network.persocket.filter bsc1272922. - CVE-2026-16526: pmdaroot privilege escalation via FDCLOEXEC fd inheritance and missing peer credentials bsc1272923. - CVE-2026-16527: missing...

CVE-2026-64575 bpf: tcp: fix double sock release on batch realloc

In the Linux kernel, the following vulnerability has been resolved: bpf: tcp: fix double sock release on batch realloc bpfitertcpbatch releases the current batch via bpfitertcpputbatch, which drops the socket refs and rewrites each slot with the socket cookie, then grows the batch. cursk/endsk ar...