CVE-2026-63994

The CVE-2026-63994 issue affects the Linux kernel's tunnels code: iptunnel_pmtud_build_icmp(v6) and iptunnel_pmtud_build_icmp() cached ip_hdr()/ipv6_hdr() before skb_cow(), which could reallocate skb->head and cause use-after-free. The patch fixes this by initializing local variables after the...

CVE-2026-63984 ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress()

In the Linux kernel, the following vulnerability has been resolved: ipv6: rpl: fix hdrlen overflow in ipv6rplsrhdecompress ipv6rplsrhdecompress computes: outhdr-hdrlen = n + 1 sizeofstruct in6addr 3; hdrlen is u8. For n = 127 the result exceeds 255 and silently truncates. With n=127 cmpri=15,...

CVE-2026-63969 ipv6: fix possible infinite loop in rt6_fill_node()

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

EUVD-2026-45742

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible infinite loop in rt6fillnode Sashiko reported this issue 1. Apply the same fix as commit f8d8ce1b515a "ipv6: fix possible infinite loop in fib6infousesdev". Writers holding tb6lock can listdelrcu&rt-fib6sibling...

CVE-2026-63924 ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo()

In the Linux kernel, the following vulnerability has been resolved: ipv6: exthdrs: refresh nh pointer after ipv6hopjumbo ipv6hopjumbo calls pskbtrimrcsum, which can change skb pointers. Let's recompute nh pointer to make sure any change won't mess things up...

EUVD-2026-45693

In the Linux kernel, the following vulnerability has been resolved: ipv6: validate extension header length before copying to cmsg ip6datagramrecvspecificctl builds IPV6HOPOPTS,DSTOPTS,RTHDR cmsgs and their IPV62292 legacy counterparts by trusting the on-wire hdrlen byte ptr1 when computing the...

EUVD-2026-45690

In the Linux kernel, the following vulnerability has been resolved: ip6: vti: Use ip6tnl.net in vti6changelink. ip netns add ns1 ip netns add ns2 ip -n ns1 link add vti6test type vti6 remote ::1 local ::2 key 7 ip -n ns1 link set vti6test netns ns2 ip -n ns2 link set vti6test type vti6 remote ::3...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63912 xfrm: esp: restore combined single-frag length gate

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

EUVD-2026-45685

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

CVE-2026-63912

The CVE concerns the Linux kernel XFRM/ESP path. The vulnerability arises in the ESP out-of-place fast path where an out-of-line trailer is written before dest page frag allocation; the head gate and tail code previously treated skb->data_len and tailen separately, risking an overflow when the...

CVE-2026-63912

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: restore combined single-frag length gate The ESP out-of-place fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. The head-side gate currently checks skb-datalen and...

EUVD-2026-45557

In the Linux kernel, the following vulnerability has been resolved: esp: fix page frag reference leak on skbtosgvec failure In espoutputtail, when esp-inplace is false, the old skb page frags are replaced with a new page from the xfrm pagefrag cache. The source scatterlist sg is built from the ol...

CVE-2026-63870

The CVE-2026-63870 issue affects linux ieee802154/6lowpan where non‑IPv6 packets (e.g., from an aoe driver) queued for transmission on a 6LoWPAN interface bypass the IPv6 check. The header creation function returns early and leaves lowpan_addr_info uninitialized in skb headroom; the transmit path...

CVE-2026-63870

In the Linux kernel, the following vulnerability has been resolved: ieee802154: 6lowpan: only accept IPv6 packets in lowpanxmit The aoe driver or similar generates a non-IPv6 packet e.g., ETHPAOE and queues it for transmission via devqueuexmit on a 6LoWPAN interface configured by the user or test...

MINI-8QG6-HHQ6-9FP9

Bulletin has no description...

MGASA-2026-0268 Updated nmap packages fix a security vulnerability

The updated packages fix a security vulnerability: Integer Underflow in IPv6 Extension Header Parsing. CVE-2026-58058...

PT-2026-61237

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An unprivileged slab-out-of-bounds read exists in the Linux kernel. The ip6 datagram recv specific ctl function trusts the on-wire hdrlen byte when computing the length for put cmsg, but...

PT-2026-61285

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the IPv6 implementation where an infinite loop can occur within the fib6 select path function. This happens because writers holding the tb6 lock may execute list del rcu...

PT-2026-61239

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the IPv6 extension header handling where the ip6 parse tlv function caches the network header pointer in nh while processing Type-Length-Value TLV structures. When ipv...