CVE-2026-64011

A flaw was found in the Linux kernel's Near Field Communication NFC Logical Link Control Protocol LLCP component. The llcpsockrelease function, which handles the release of LLCP sockets, can incorrectly unlink a socket while it is still in a connecting state. This can result in a use-after-free...

CVE-2026-13067: Incorrect Authorization

When PROXY protocol v2 is used on the Unix domain socket path, roles derived from X.509 client certificates may not be validated against the configured tlsCATrusts allow-list. This can result in unintended role assignments following MONGODB-X509 authentication. Affected scenarios require local...

podman security update

5.8.2-5.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 7:5.8.2-5 - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 7:5.8.2-4 - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-39829 CVE-2026-39830 CVE-2026-39832...

buildah security update

1.43.1-4.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-4 - rebuild for CVE-2026-39822 - Resolves: RHEL-193643 2:1.43.1-3 - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Resolves: RHEL-186266 2:1.43.1-2 - Rebuild for CVE-2026-25679 -...

CVE-2026-63970

A flaw was found in the Linux kernel's vsock/virtio transport. This vulnerability occurs when the system processes zerocopy socket buffers skbs and encounters an error during memory allocation for fixed-buffer vectored data. The system may attempt to free memory incorrectly, leading to a...

UBUNTU-CVE-2026-46968

Vulnerability in Oracle Java SE component: JSSE. Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle GraalVM for JDK: 17.0.19 and 21.0.11; Oracle GraalVM Enterprise Edition: 21.3.18. Difficult to exploit vulnerability allow...

GHSA-9MQV-5HH9-4CGG Node.js Adapter for Hono: Unauthenticated memory-leak DoS via aborted WebSocket handshake

Summary A WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header leaks memory permanently. The request's IncomingMessage is retained in an internal map and a pending promise is never settled, even though no connection is established. Since the...

socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests

A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP...

CVE-2026-63871

A flaw was found in the Linux kernel's Bluetooth ISO subsystem. This vulnerability, a data-race, occurs because certain functions access socket-related data without proper synchronization. Specifically, isoconnectbis, isoconnectcis, isolistenbis, and isoconnbigsync can read critical fields while...

SUSE CVE-2026-47128

nono is software that allows users to run AI agents in a zero-latency sandbox. Prior to version 0.55.0, the nono Landlock/seccomp policies allow access to local Unix domain sockets concrete and abstract. This allows an easy sandbox escape by talking to the per-user systemd dbus socket. Version...

SUSE CVE-2026-63926

In the Linux kernel, the following vulnerability has been resolved: bpf: sockmap: fix tail fragment offset in bpfmsgpushdata When bpfmsgpushdata inserts data in the middle of a scatterlist entry, it splits the original entry into a left fragment and a right fragment. The right fragment offset is...

SUSE CVE-2026-63945

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: serialize isosockcleartimer with socket lock isosockclose calls isosockcleartimer before acquiring locksocksk. isosockcleartimer reads isopisk-conn twice without the socket lock held: if !isopisk-conn return;...

SUSE CVE-2026-63971

In the Linux kernel, the following vulnerability has been resolved: sctp: fix race between sctpwaitforconnect and peeloff sctpwaitforconnect drops and re-acquires the socket lock while waiting for the association to reach ESTABLISHED state. During this window, another thread can peeloff the...

SUSE CVE-2026-64011

In the Linux kernel, the following vulnerability has been resolved: nfc: llcp: Fix use-after-free in llcpsockrelease llcpsockrelease unconditionally unlinks the socket from the local sockets list. However, if the socket is still in connecting state, it is on the connecting list. Fix this by...

SUSE CVE-2026-64024

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcptwisn leak enabling ISN prediction Blamed commit moved the TIMEWAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcpconnrequest for the sam...

SUSE CVE-2026-64035

In the Linux kernel, the following vulnerability has been resolved: igc: set tx buffer type for SMD frames Sashiko pointed out that igcfpeinitsmdframe initializes igctxbuffer fields for an SMD skb, but does not set the buffer type:...

SUSE CVE-2026-64045

In the Linux kernel, the following vulnerability has been resolved: ovpn: tcp - use cached peer pointer in ovpntcpclose ovpntcpclose loads the ovpnsocket via rcudereferenceskuserdata under rcureadlock, takes a reference on sock-peer, caches the peer pointer in a local, and drops the read lock. It...

SUSE CVE-2026-64055

In the Linux kernel, the following vulnerability has been resolved: net: ethernet: cortina: Carry over frag counter The gmacrx NAPI poll function assembles packets in an SKB from a ring buffer. If the ring buffer gets completely emptied during a poll cycle, we exit gmacrx, but the packet is not y...

SUSE CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

SUSE CVE-2026-64177

In the Linux kernel, the following vulnerability has been resolved: phonet/pep: disable BH around forwarded skreceiveskb The networking receive path is usually run from softirq context, but protocols that take the socket lock may have packets stored in the backlog and processed later from process...